wifi: iwlwifi: acpi: validate WGDS table revision index

Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when
firmware reports an invalid revision value.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.52a01f841f2a.Ic0131eaac31d9ff71b169138d9b0865cb39b44a9@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index bf0f851a907554c99e78a3039c89e220d7de9a13..430a7642e01a32b4168bb422cf3ce5c56ebf5b86 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -865,6 +865,11 @@ int iwl_acpi_get_wgds_table(struct iwl_fw_runtime *fwrt)
                                                       min_size, max_size,
                                                       &tbl_rev);
                if (!IS_ERR(wifi_pkg)) {
+                       if (tbl_rev < 0 ||
+                           tbl_rev >= BITS_PER_BYTE *
+                           sizeof(rev_data[idx].revisions))
+                               continue;
+
                        if (!(BIT(tbl_rev) & rev_data[idx].revisions))
                                continue;