wifi: iwlwifi: uefi: bound PPAG revision bitmap shift

Validate revision is below 32 before BIT(revision) in PPAG parsing.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.d116dd2efdc1.I3c6cae5cb9d0acc2d94544bc755b0754a91b10ba@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
index 2ef0a7a920adb5e2fb87242063d763b03c7647ee..014f22c42f41a9d96bc92511746cc26867199ec3 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
@@ -700,7 +700,7 @@ int iwl_uefi_get_ppag_table(struct iwl_fw_runtime *fwrt)
        return -EINVAL;
 
 parse_table:
-       if (!(BIT(data->revision) & valid_rev)) {
+       if (data->revision >= 32 || !(BIT(data->revision) & valid_rev)) {
                ret = -EINVAL;
                IWL_DEBUG_RADIO(fwrt,
                                "Unsupported UEFI PPAG revision:%d\n",