]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: iwlwifi: mvm: validate sta_id in BA window status notif
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Tue, 14 Jul 2026 11:19:59 +0000 (14:19 +0300)
committerMiri Korenblit <miriam.rachel.korenblit@intel.com>
Tue, 14 Jul 2026 17:45:20 +0000 (20:45 +0300)
commit6aa77efaea9efea92e3090c35ad348fd759a3cf3
tree1ce8d9e20b118dd8cccaed386805f3e900b4a769
parent3ed8d1705d3aa5fbec918b8e241b41c483706cc2
wifi: iwlwifi: mvm: validate sta_id in BA window status notif

BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the
firmware notification and uses it to index fw_id_to_mac_id[] without
bounds checking. Validate sta_id before array access to prevent
out-of-bounds indexing.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.2e97f337f3cb.Ic3f0f404082ccdea13809a3c0b70e0f5417e1037@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
drivers/net/wireless/intel/iwlwifi/mvm/rx.c