wifi: iwlwifi: mld: validate reorder BAID

Reject BAIDs >= IWL_MAX_BAID before indexing fw_id_to_ba.

This prevents out-of-bounds access on malformed notifications.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.07ea823b8eea.Ica915fa0cce0427bf5e3420ae933f57118fedf86@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index e3627ad0321c8b3e41d491ef76a3213b1c702ec1..a464ebdec57f133fff25eec97b1abafac3a6829a 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
  */
 #include "agg.h"
 #include "sta.h"
@@ -222,6 +222,11 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
        if (baid == IWL_RX_REORDER_DATA_INVALID_BAID)
                return IWL_MLD_PASS_SKB;
 
+       if (IWL_FW_CHECK(mld, baid >= ARRAY_SIZE(mld->fw_id_to_ba),
+                        "Got out-of-range BAID %u in reorder_data=0x%x\n",
+                        baid, reorder))
+               return IWL_MLD_PASS_SKB;
+
        /* no sta yet */
        if (WARN_ONCE(!sta,
                      "Got valid BAID without a valid station assigned\n"))