wifi: iwlwifi: mvm: validate mac_link_id in session protect notif

Check the mac_id before accessing the vif_id_to_mac array.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.547ea470e686.I931445ae6f37bf0e1ef6f112c811712fc48af9c9@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 1692b6e75f579d68201ad22ff7bb87cd93a86b2b..93b46c9e2333d52fec240fa85b945691a63651dc 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -951,6 +951,11 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
        struct ieee80211_vif *vif;
        struct iwl_mvm_vif *mvmvif;
 
+       if (IWL_FW_CHECK(mvm, id >= ARRAY_SIZE(mvm->vif_id_to_mac),
+                        "Invalid mac_link_id (%d) in session protect notif\n",
+                        id))
+               return;
+
        rcu_read_lock();
 
        /* note we use link ID == MAC ID */