wifi: iwlwifi: mvm: validate sta_id in TLC notif

TLC_MNG_UPDATE_NOTIF uses firmware-provided sta_id to index
fw_id_to_link_sta[] and fw_id_to_mac_id[]. Validate sta_id
before array access to avoid out-of-bounds indexing.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.1ce54794c1f8.I275fd4c1165bf42fb17516c550dd8813a2b8286e@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
index 89ac4c6b3e543d8566c112acfa7554ef3ac0d004..e2382be8edd78da05625f9ca6ff550139896cb45 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
  * Copyright (C) 2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
  */
 #include "rs.h"
 #include "fw-api.h"
@@ -423,9 +423,14 @@ void iwl_mvm_tlc_update_notif(struct iwl_mvm *mvm,
        struct iwl_lq_sta_rs_fw *lq_sta;
        u32 flags;
 
+       notif = (void *)pkt->data;
+       if (IWL_FW_CHECK(mvm, notif->sta_id >= mvm->fw->ucode_capa.num_stations,
+                        "Invalid sta id (%d) in TLC notification\n",
+                        notif->sta_id))
+               return;
+
        rcu_read_lock();
 
-       notif = (void *)pkt->data;
        link_sta = rcu_dereference(mvm->fw_id_to_link_sta[notif->sta_id]);
        sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
        if (IS_ERR_OR_NULL(sta) || !link_sta) {