wifi: iwlwifi: mld: validate txq_id in TX response handler

Validate txq_id from TX response notification before passing to
iwl_trans_reclaim(). Other reclaim paths in this file perform this
check to prevent out-of-bounds access on malformed notifications.

Assisted-by: GitHubCopilot:claude-haiku-4.5
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.b938c2dcf08d.I8a88ec359e229f1c41ac9c49fd9ce28a2b62b274@changeid

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
index 2185dade95f8cbfe137f4bc4c376dcb95c052ac9..2df6643a5aa80f54aa8b6be43c2a148050cffdc4 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
@@ -1120,6 +1120,10 @@ void iwl_mld_handle_tx_resp_notif(struct iwl_mld *mld,
        ssn = le32_to_cpup((__le32 *)agg_status +
                           tx_resp->frame_count) & 0xFFFF;
 
+       if (IWL_FW_CHECK(mld, txq_id >= ARRAY_SIZE(mld->fw_id_to_txq),
+                        "Invalid txq id %d\n", txq_id))
+               return;
+
        __skb_queue_head_init(&skbs);
 
        /* we can free until ssn % q.n_bd not inclusive */