wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

ba_notif->tid is a firmware-controlled u8 that is used directly
as an array index into tid_data[] without any validation. Add a
bounds check against IWL_MAX_TID_COUNT before dereferencing the
array.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.d7c3e75d47af.If88948108cfc8b5fb3ce5531d927855d1b3b6b30@changeid

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index e02c376296c497d1832a76beacf8ff8e625c335d..d3c2fe8304777b2a873595e207856b9812620038 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -2161,6 +2161,9 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
        ba_notif = (void *)pkt->data;
        sta_id = ba_notif->sta_id;
        tid = ba_notif->tid;
+       if (IWL_FW_CHECK(mvm, tid >= ARRAY_SIZE(mvmsta->tid_data),
+                        "invalid TID %d in BA notif\n", tid))
+               return;
        /* "flow" corresponds to Tx queue */
        txq = le16_to_cpu(ba_notif->scd_flow);
        /* "ssn" is start of block-ack Tx window, corresponds to index