[PATCH 1/2] wifi: iwlwifi: mvm: check BA-window station ID before lookup

[Michael Bommarito]

iwl_mvm_window_status_notif() extracts a station ID from the BA-window
status notification's ra_tid field. The firmware API allocates five bits
for that field, so it can encode values up to 31.

The station map is bounded by the firmware's station capacity and
physically sized to IWL_STATION_COUNT_MAX entries. Validate the extracted
station ID before indexing fw_id_to_mac_id[]. This matches the existing
MVM station lookup helpers, which reject IDs outside
mvm->fw->ucode_capa.num_stations before reading the station map.

Fixes: 3af512d6aac7 ("iwlwifi: mvm: support filtered frames notification")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 269c4b45de807..d373f0723e13d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -7,6 +7,7 @@
 #include <linux/unaligned.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
+#include "iwl-drv.h"
 #include "iwl-trans.h"
 #include "mvm.h"
 #include "fw-api.h"
@@ -1227,6 +1228,8 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
 		/* get the station */
 		sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK)
 			 >> BA_WINDOW_STATUS_STA_ID_POS;
+		if (sta_id >= mvm->fw->ucode_capa.num_stations)
+			continue;
 		sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 		if (IS_ERR_OR_NULL(sta))
 			continue;
@@ -1239,3 +1242,4 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
 	}
 	rcu_read_unlock();
 }
+EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mvm_window_status_notif);
-- 
2.53.0