From: Emmanuel Grumbach Date: Fri, 17 Jul 2026 14:33:39 +0000 (+0300) Subject: wifi: iwlwifi: uefi: bound PPAG revision bitmap shift X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9ba1e0a4060e5a4802ccb9c9defa946c1aa6c629;p=thirdparty%2Fkernel%2Flinux.git wifi: iwlwifi: uefi: bound PPAG revision bitmap shift Validate revision is below 32 before BIT(revision) in PPAG parsing. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20260717173215.d116dd2efdc1.I3c6cae5cb9d0acc2d94544bc755b0754a91b10ba@changeid Signed-off-by: Miri Korenblit --- diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c index 2ef0a7a920ad..014f22c42f41 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c @@ -700,7 +700,7 @@ int iwl_uefi_get_ppag_table(struct iwl_fw_runtime *fwrt) return -EINVAL; parse_table: - if (!(BIT(data->revision) & valid_rev)) { + if (data->revision >= 32 || !(BIT(data->revision) & valid_rev)) { ret = -EINVAL; IWL_DEBUG_RADIO(fwrt, "Unsupported UEFI PPAG revision:%d\n",