[PATCH AUTOSEL 6.18-6.6] wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
From: Sasha Levin
Date: Mon Aug 31 2026 - 11:26:05 EST
From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
[ Upstream commit 0e4c0d83267261cf67ec9690856edf4a56bb7dfc ]
ba_notif->tid is a firmware-controlled u8 that is used directly
as an array index into tid_data[] without any validation. Add a
bounds check against IWL_MAX_TID_COUNT before dereferencing the
array.
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
Link: https://patch.msgid.link/20260715215523.d7c3e75d47af.If88948108cfc8b5fb3ce5531d927855d1b3b6b30@changeid
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
LLM Generated explanations, may be completely bogus:
# Stable Backport Analysis: `wifi: iwlwifi: mvm: add a check on the tid
coming from the firmware`
**Local tree:** Linux **6.18.44** (`v6.18.44-2-g1b9e1abadee04`, `make
kernelversion` → 6.18.44)
---
## PHASE 1: COMMIT MESSAGE FORENSICS
**Step 1.1 — Subject line**
Record: `[wifi: iwlwifi: mvm]` `[add]` — add bounds validation on
firmware-supplied TID in legacy BA notification handler.
**Step 1.2 — Tags**
Record:
- `Assisted-by: GitHubCopilot:gpt-5.3-codex`
- `Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx>`
- `Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>`
- `Link:` patch.msgid.link (redirects to lore; blocked by bot
protection)
- No `Fixes:`, `Reported-by:`, `Cc: stable`, `Tested-by:`, or `Reviewed-
by:` tags
- Part of Intel iwlwifi fix series `[PATCH 12/15]` (2026-07-15)
**Step 1.3 — Body analysis**
Record:
- **Bug:** `ba_notif->tid` is firmware-controlled `u8`, used directly as
`tid_data[]` index without validation.
- **Symptom:** Out-of-bounds access into `mvmsta->tid_data[]` when
firmware sends invalid TID.
- **Root cause:** Missing bounds check before `&mvmsta->tid_data[tid]`
dereference in legacy (non-compressed) BA notification path.
- No explicit crash report or syzbot reference; defensive validation of
untrusted firmware input.
**Step 1.4 — Hidden bug fix?**
Record: **Yes** — despite “add a check” wording, this is a real memory-
safety bug fix (out-of-bounds array index), not cosmetic cleanup.
---
## PHASE 2: DIFF ANALYSIS
**Step 2.1 — Inventory**
Record:
- **File:** `drivers/net/wireless/intel/iwlwifi/mvm/tx.c` (+3 lines)
- **Function:** `iwl_mvm_rx_ba_notif()`
- **Scope:** Single-file, surgical fix in one error-handling path
**Step 2.2 — Code flow change**
Record:
- **Before:** `tid = ba_notif->tid` → RCU lock → STA lookup → `tid_data
= &mvmsta->tid_data[tid]` (unchecked).
- **After:** Same, but return early via `IWL_FW_CHECK()` if `tid >=
ARRAY_SIZE(mvmsta->tid_data)`.
- Affects the **legacy** BA notification path
(`!iwl_mvm_has_new_tx_api()`), not the compressed-BA path at the top
of the function.
**Step 2.3 — Bug mechanism**
Record:
- **Category:** Buffer overflow / out-of-bounds array access (memory
safety).
- **Mechanism:** `tid_data` is `struct iwl_mvm_tid_data
tid_data[IWL_MAX_TID_COUNT + 1]` (9 elements, indices 0–8).
`ba_notif->tid` is `u8` (0–255). Values ≥ 9 cause OOB read at:
```2176:2180:drivers/net/wireless/intel/iwlwifi/mvm/tx.c
tid_data = &mvmsta->tid_data[tid];
ba_info.status.ampdu_ack_len = ba_notif->txed_2_done;
ba_info.status.ampdu_len = ba_notif->txed;
ba_info.status.tx_time = tid_data->tx_time;
```
- `iwl_mvm_tx_reclaim()` has `tid > IWL_MAX_TID_COUNT` guard, but that
runs **after** the OOB access above.
**Step 2.4 — Fix quality**
Record:
- Fix is minimal and follows existing `IWL_FW_CHECK()` pattern in the
same function (STA ID check at lines 2169–2173).
- `ARRAY_SIZE(mvmsta->tid_data)` is compile-time only (no runtime
dereference of uninitialized `mvmsta`); equivalent to `tid >
IWL_MAX_TID_COUNT`.
- Low regression risk; only rejects invalid firmware values.
- Note: related patch 11/15 in the same series fixes a **different** bug
in the compressed-BA path (`tid_data[i]` vs `tid_data[tid]`); this
commit is standalone for the legacy path.
---
## PHASE 3: GIT HISTORY INVESTIGATION
**Step 3.1 — Blame**
Record: Legacy BA-notif code at lines 2158–2200 traces to
`5d324e5159d9e` (6.18 merge base). Shallow history limits deeper blame;
function has been in iwlwifi MVM for many releases.
**Step 3.2 — Fixes: tag**
Record: N/A — no `Fixes:` tag present.
**Step 3.3 — Related file history**
Record: This tree has multiple recent iwlwifi validation fixes
backported (e.g. `dd90880` OOB read, `2d5dec5` wake-packet read,
`a076b0c` SAR GEO validation). This TID check is **not** yet present.
Patch 11/15 (compressed-BA `tid_data[i]` fix) is also **not** in this
tree.
**Step 3.4 — Author context**
Record: Emmanuel Grumbach and Miri Korenblit are Intel iwlwifi
maintainers. Part of a 15-patch Intel fix batch from 2026-07-15.
**Step 3.5 — Dependencies**
Record: **Standalone.** No prerequisite commits required. Applies to
existing legacy path only.
---
## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH
**Step 4.1 — Original discussion**
Record: Patch found in local mbox
`20260715_miriam_rachel_korenblit_wifi_iwlwifi_fixes_07_15_2026.mbx` as
`[PATCH 12/15]`. `b4 dig` and lore.kernel.org blocked by Anubis bot
protection; could not fetch live thread. No stable nomination found in
available sources.
**Step 4.2 — Reviewers**
Record: UNVERIFIED from live lore. Cover letter shows Intel iwlwifi
maintainers as authors; series is internal Intel bugfix batch.
**Step 4.3 — Bug report**
Record: No external bug report, syzbot, or user crash report referenced.
Bug identified via code review (GitHub Copilot assisted).
**Step 4.4 — Series context**
Record: Patch 11/15 fixes compressed-BA path (wrong index + bounds
check). Patch 12/15 fixes legacy path (missing bounds check).
Independent; either can be backported alone.
**Step 4.5 — Stable list history**
Record: UNVERIFIED — lore stable search blocked.
---
## PHASE 5: CODE SEMANTIC ANALYSIS
**Step 5.1 — Key functions**
Record: `iwl_mvm_rx_ba_notif()` modified.
**Step 5.2 — Callers**
Record: Registered as `RX_HANDLER(BA_NOTIF, iwl_mvm_rx_ba_notif, ...)`
in `ops.c` line 320. Invoked synchronously on firmware BA notification —
hot TX completion path.
**Step 5.3 — Callees**
Record: After TID handling, calls `iwl_mvm_tx_reclaim()` and accesses
`tid_data->tx_time`, `tid_data->rate_n_flags`.
**Step 5.4 — Reachability**
Record:
- Reachable whenever firmware sends `BA_NOTIF` on devices with **legacy
TX API** (`!iwl_mvm_has_new_tx_api()` → `!mac_cfg->gen2`).
- Covers older Intel WiFi hardware still supported in 6.18.y.
- Trigger requires malformed/corrupt firmware notification (firmware
bug, corruption, or hostile firmware).
**Step 5.5 — Similar patterns**
Record: Driver consistently validates TIDs elsewhere (`WARN_ON_ONCE(tid
>= IWL_MAX_TID_COUNT)` in `tx.c:964`, `sta.c:3089`, `rs.c:593`, etc.).
This path was an outlier missing validation.
---
## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE
**Step 6.1 — Buggy code present?**
Record: **YES.** At lines 2160–2176 in this 6.18.44 tree, `tid =
ba_notif->tid` is used without bounds check before `tid_data =
&mvmsta->tid_data[tid]`. Fix is **not** present.
**Step 6.2 — Backport complications**
Record: **Clean apply expected.** 3-line insertion at a stable location;
no structural conflicts visible. `IWL_FW_CHECK` macro exists in
`fw/dbg.h`.
**Step 6.3 — Related fixes already present?**
Record: No. `git log --grep="check on the tid"` and `--grep="invalid
TID"` return nothing for this fix. Compressed-BA patch 11/15 also not
applied (`tid_data[i]` still at line 2141).
---
## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT
**Step 7.1 — Subsystem**
Record: `drivers/net/wireless/intel/iwlwifi/mvm` — **IMPORTANT** (Intel
WiFi, widely deployed; not core kernel but affects many
laptops/desktops).
**Step 7.2 — Activity**
Record: Actively maintained; multiple iwlwifi validation fixes already
backported to this 6.18.44 tree in 2026.
---
## PHASE 8: IMPACT AND RISK ASSESSMENT
**Step 8.1 — Who is affected**
Record: Users of Intel WiFi devices using legacy MVM TX API (pre-gen2
MAC config). Driver-specific, but Intel WiFi is very common on x86
laptops.
**Step 8.2 — Trigger conditions**
Record: Firmware sends `BA_NOTIF` with `tid >= 9` on legacy path.
Unlikely in normal operation, but plausible with firmware bugs or
corruption. Not userspace-triggerable directly, but firmware is treated
as untrusted input in stable security practice.
**Step 8.3 — Failure mode severity**
Record: Out-of-bounds read (and potential write via subsequent
`iwl_mvm_tx_reclaim` using corrupted `tid_data`) → kernel oops, memory
corruption. **Severity: HIGH** (memory safety; possible
crash/corruption).
**Step 8.4 — Risk vs benefit**
Record:
- **Benefit:** Prevents OOB access on a firmware-driven hot path; aligns
with other iwlwifi validation backports already in this tree.
- **Risk:** Very low — 3-line defensive check, rejects only invalid
values.
- **Ratio:** Strong benefit, minimal risk.
---
## PHASE 9: FINAL SYNTHESIS
**Step 9.1 — Evidence summary**
| FOR backport | AGAINST backport |
|---|---|
| Real OOB bug on firmware-controlled index | No user crash report or
syzbot reproducer |
| HIGH severity if triggered (crash/corruption) | Legacy TX API only
(not newest gen2 devices) |
| 3-line, obviously correct fix | Part of 15-patch series (but this
patch is standalone) |
| Matches pattern of iwlwifi fixes already in 6.18.44 | Live lore review
unverified |
| Intel maintainer-authored | |
| Buggy code confirmed present in this tree | |
| Fix not yet applied | |
**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** — logic is straightforward; no
runtime test cited but pattern is established in-driver.
2. Fixes a real bug? **PASS** — confirmed OOB array index without
validation.
3. Important issue? **PASS** — memory safety / potential crash (HIGH).
4. Small and contained? **PASS** — 3 lines, one function.
5. No new features/APIs? **PASS** — defensive validation only.
6. Can apply to local tree? **PASS** — buggy code exists; clean apply
expected.
**Step 9.3 — Exception categories**
Record: None (not device ID, quirk, DT, build, or docs). Standard bug-
fix category.
**Step 9.4 — Decision rationale**
This commit closes a genuine out-of-bounds access hole where firmware-
controlled `tid` is used to index `tid_data[9]` without validation, on a
path that still exists in Linux 6.18.44. The fix is minimal, follows
existing conventions, and matches the class of iwlwifi validation fixes
already backported to this stable tree. Even without a public crash
report, validating firmware-controlled array indices is appropriate
stable material given the severity of the failure mode.
---
## Verification
- **[Phase 1]** Parsed commit message from user query and local mbox
`20260715_miriam_rachel_korenblit_wifi_iwlwifi_fixes_07_15_2026.mbx`
- **[Phase 2]** Read `tx.c` lines 2073–2201; confirmed OOB access before
`iwl_mvm_tx_reclaim()` guard
- **[Phase 2]** Verified `tid_data` size: `IWL_MAX_TID_COUNT + 1` = 9 in
`sta.h:410`; `IWL_MAX_TID_COUNT` = 8 in `iwl-trans.h:271`
- **[Phase 2]** Verified `iwl_mvm_tx_reclaim()` has `tid >
IWL_MAX_TID_COUNT` at `tx.c:1940-1942` but runs after OOB access
- **[Phase 3]** `git blame` on lines 2160–2189 → `5d324e5159d9e`
- **[Phase 3]** `git log --grep` — fix not present in tree
- **[Phase 4]** Read patch 12/15 from local mbox; cover letter shows
series context
- **[Phase 4]** `b4 dig` and lore.kernel.org — blocked by Anubis
(UNVERIFIED live review)
- **[Phase 4]** patch.msgid.link — blocked by Anubis (UNVERIFIED)
- **[Phase 5]** `grep iwl_mvm_rx_ba_notif` — handler in `ops.c:320`
- **[Phase 5]** `iwl_mvm_has_new_tx_api()` → `mac_cfg->gen2` in
`mvm.h:1515-1518`
- **[Phase 6]** `git describe HEAD` → v6.18.44; `make kernelversion` →
6.18.44
- **[Phase 6]** Confirmed fix absent at `tx.c:2160` (no bounds check)
- **[Phase 6]** Confirmed related patch 11/15 also absent (`tid_data[i]`
at line 2141)
- **[Phase 7]** `git log --oneline -20 --grep=iwlwifi` — active iwlwifi
stable backports
- **[Phase 8]** Assessed failure mode as OOB read/write →
crash/corruption (HIGH)
**YES**
drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 30aee52bf9cb4..ebb201bd23d85 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -2192,6 +2192,9 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
ba_notif = (void *)pkt->data;
sta_id = ba_notif->sta_id;
tid = ba_notif->tid;
+ if (IWL_FW_CHECK(mvm, tid >= ARRAY_SIZE(mvmsta->tid_data),
+ "invalid TID %d in BA notif\n", tid))
+ return;
/* "flow" corresponds to Tx queue */
txq = le16_to_cpu(ba_notif->scd_flow);
/* "ssn" is start of block-ack Tx window, corresponds to index
--
2.53.0