From nobody Sat Jul 25 23:03:38 2026 Received: from mail-qk1-f178.google.com (mail-qk1-f178.google.com [209.85.222.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 824602DB78C for ; Sat, 11 Jul 2026 15:06:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782377; cv=none; b=PAHrq5VD9z4Ab9qAiQRt1Mvuw23obw0oO2EkUjT86rPZhsod6Nl6jGtJUkQeEgPqIYKngER07dI/K1YeVIXMZsPj7Pc47UdMfVJt6/gVVD/xN4E6S3ymt4nm+WvmZJCB/4kBNSAfUJCkW4I7Yt3r6/FIvvzzReBtT6HGxGwmYpg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782377; c=relaxed/simple; bh=8UpyJxckMHUMLlbtyRgGGg26hezMZtk8A8xmtE1pZOA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pGaMLZAc+8F17zRRtThqINLrMn81036P4Ewtir2pF6AjyAoHIzvRs3ROop5MGzQHAv/oHOXnvojdJuWB4qvTORrcz87T4rz7E+yjNp+7tpEcTsJRYZB7d1mufwYfrc5tr0TZPY9Z1th/aRYNEsRVZD33zs7gx9YmB+MSWjUnVIU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fCoUiTr8; arc=none smtp.client-ip=209.85.222.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fCoUiTr8" Received: by mail-qk1-f178.google.com with SMTP id af79cd13be357-92e4fd65b2bso91596685a.0 for ; Sat, 11 Jul 2026 08:06:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783782374; x=1784387174; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qPPgg5HFLluz6FRieBbyWJGx0FqM2rMhvYorHbuk6xc=; b=fCoUiTr86kQgSOzvsiKKYan57Tzz96PAu1bQQFWsiLD42jy+sf5z5Q3L2+J0aeiwdn spHXZekJZSooLr+afeoljgnaca6KOzJErLXDNK7YtgLE3ncbupR3DZ8bbroJkBypCdXZ 0oLIP3r9DOQeG5iFU//9EzXaLMGu7HFWkZnUbgNLz4/IexjiW02dCmnnU2uetLZYLgr9 pvg4SsibPrwnEN2nVdJLm6NA8TOW7zF21ZTiTcPpZJY20UZjvbzD9UPLZpXVPg4MLTWY CpWAvIbC7ePdk/a/7qfcpiRLro7sdW4bit3PAIiFdERbH4ZbpmFN5KSxrt0uCoiRWdUT /y7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783782374; x=1784387174; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qPPgg5HFLluz6FRieBbyWJGx0FqM2rMhvYorHbuk6xc=; b=iKV8zgGz/TsOigKrYvRr/P9D0eE31zalg5QFLMzXNMlMkdfhgoetq1MDxpN1D/rBKA j0eDcydg3z+IQnAzJcTPUc89V69tDNJl/u11q7r3+U1M2C0cd7c9AhFnmuWXdl67eIjL IE1o6WUsnaUSYzWkLdD52TowOarSYRSYBeeI0SVh1UEh8tLHklj36g8UKEeNRPd4EV89 DCBqalSz1N1vFHpLFQF3dn0eHGUYUDJ0bLKhIoiVdL8pfbzZHto/eNT2xd7qBRGRQ1IE At8Ixp3fzzfignU5GWy1//55V9mUGDEPjY92lMy0vtfstwMB1eQ6xG5u7eUkQgc5XhzR NwXg== X-Forwarded-Encrypted: i=1; AHgh+RqXYvKk/KNKTYj5n/40OWT3vwirkHCSIqrRwkenZWaiokQj7mFbQliOq0X7FYDxApr8PggkHiFllCsHUIE=@vger.kernel.org X-Gm-Message-State: AOJu0Yz8clf/sz5xSFQpcVzLaw0B4hupto4jJ+hlhuPEtRTScwzvr0I9 +EJIFmoBVC2DH6tN9cLrShJSO5EYS05RWght/ziGRqE28FfVmekAvRfj X-Gm-Gg: AfdE7clM0vNgZnIRnT0PmEvhpIp3ojlv9fWCJhQiRePeBjKCCzTuoURF+IApelNf2r3 80DQems4uDo51JosZ3MZZffovHUj2TmNAhJS14OxZj1SqygOgIvRKnfAxSn/Td6VG0UijqRDKmj 8IMoXT0liiDrFKZ3Ee7lTP094jmnIiwr2+Tkv2e/LXOmjIFbnaMiYHKdvMfxKJJxgpi5G700Lwt ss4Z9whaacGh0bZokqQ1t0yv+yVdpFrDViNS60Q0txIagQFf3/TcvK5NV6nQme/enN/0GNkDpmp Xzsa341A+HjMUEE0acB50Vc2sr8Xjg7mKuBTR7IhE+Syx1cuol9vDDshn8/NFOx7YH2WrquIGWc Moyj1BcSbDIBRHVsF2HN/UDKmFahdhP3m9mjIwpM2aRlOAKJamPn2AwNuS/ss2Ev7p7ujKlsIAB lTrNOqGPKEDVdmpGiHpgBcRKUm6H8EcY8DbLUir+7Rxp6NZCv+4/g9nC74wDACMpA4eqRvMAoeV MKliaPXAw== X-Received: by 2002:a05:620a:298b:b0:92e:72a4:f282 with SMTP id af79cd13be357-92ef2c1fc21mr314510985a.46.1783782374433; Sat, 11 Jul 2026 08:06:14 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5d68e5fsm464578285a.43.2026.07.11.08.06.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 08:06:13 -0700 (PDT) From: Michael Bommarito To: Miri Korenblit , Johannes Berg Cc: Emmanuel Grumbach , Benjamin Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/2] wifi: iwlwifi: mvm: check BA-window station ID before lookup Date: Sat, 11 Jul 2026 11:06:10 -0400 Message-ID: <20260711150611.2913332-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260711150611.2913332-1-michael.bommarito@gmail.com> References: <20260711150611.2913332-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iwl_mvm_window_status_notif() extracts a station ID from the BA-window status notification's ra_tid field. The firmware API allocates five bits for that field, so it can encode values up to 31. The station map is bounded by the firmware's station capacity and physically sized to IWL_STATION_COUNT_MAX entries. Validate the extracted station ID before indexing fw_id_to_mac_id[]. This matches the existing MVM station lookup helpers, which reject IDs outside mvm->fw->ucode_capa.num_stations before reading the station map. Fixes: 3af512d6aac7 ("iwlwifi: mvm: support filtered frames notification") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wire= less/intel/iwlwifi/mvm/rx.c index 269c4b45de807..d373f0723e13d 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c @@ -7,6 +7,7 @@ #include #include #include +#include "iwl-drv.h" #include "iwl-trans.h" #include "mvm.h" #include "fw-api.h" @@ -1227,6 +1228,8 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm, /* get the station */ sta_id =3D (ratid & BA_WINDOW_STATUS_STA_ID_MSK) >> BA_WINDOW_STATUS_STA_ID_POS; + if (sta_id >=3D mvm->fw->ucode_capa.num_stations) + continue; sta =3D rcu_dereference(mvm->fw_id_to_mac_id[sta_id]); if (IS_ERR_OR_NULL(sta)) continue; @@ -1239,3 +1242,4 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm, } rcu_read_unlock(); } +EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mvm_window_status_notif); --=20 2.53.0 From nobody Sat Jul 25 23:03:38 2026 Received: from mail-qk1-f170.google.com (mail-qk1-f170.google.com [209.85.222.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF33933D4F2 for ; Sat, 11 Jul 2026 15:06:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782378; cv=none; b=RJQ4iRSip6zCudnVL7X0e/1Ch6RpghJ7vwgrOXLtu1krw+gpGJoZ9wcusKOcMvj3v+JGSQNzkzOLDY7OxN2wPOeTMzi+cuyDDeXmU9iVSLkMmRhEpGDr8K2hkF4ZO0cGpBPsQkO50XtpfCNCUXK/qzcd2sywSGV0T1vdh2e3pTk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782378; c=relaxed/simple; bh=b0Csvthvox+ZikmYZaH+PCSy1gktpVVyy/GCAs1XN5o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mxfoeUXjlgiDVYzypff0jOpgMeG2KceTNFEKFLs3tLXRsoqLnLKzm8rOVE9t1Bs+eRkOoVk7ctN8lGXDs3RIU3zlJShM1gpBAbADIob3rq3f/nxWgeszse//LRNcJkvMFp/dTWUicp1JKur5YiKZ8zyXK+A8P9rcXeLMYmhu2Z0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KBxwkMw9; arc=none smtp.client-ip=209.85.222.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KBxwkMw9" Received: by mail-qk1-f170.google.com with SMTP id af79cd13be357-92e85499ffbso152190385a.0 for ; Sat, 11 Jul 2026 08:06:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783782375; x=1784387175; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Gg+ng2VSqRvXrUN5u/dXzTCEv77wgL5YHqysVwmsFOE=; b=KBxwkMw94dijwIu7KeD0+36XbwQhET1hFLojN7VaPTWFLs1/l2g9gGRVX4e5bTTvhj fxfbXO2We+eT1/sQPC0LnW7DKsmT+P9NfO4fgBVmBlzftcab4a898a813DUecYViNCTI ZFwxwecQfdWJnfJDxwjHu7fnBvedDK5vZXBngJeTeDzLG2O1sHJXHnMi9IlLdtWmOTNW cLJDLa6qe/zFhJ9Yg0VeKenfyL/e7dGuEokGAPTofvM/AobDktwSt1iC45GSFkoLGN7f +aNNuJWzWW82h7EtO8UPdERB5dtHPs9GxkJbuKvEh05T+ecDMvh/J3M/EgIFPrYEqdPP dimQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783782375; x=1784387175; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Gg+ng2VSqRvXrUN5u/dXzTCEv77wgL5YHqysVwmsFOE=; b=od/v3Dn4vtqDyXlywn2x+FCgVO8g5FYHNX9EGtpXkDW9ZE7UoZWoMIxrvf8BhntntH chL4UfH8cJT59lCV0mW2Oam4wFBXrXrEZREKQwOegFye0cc67UN6e03XDvxcRTgivjV6 ioMjSAkY0M5gARR9JysorP4UI/ZcJpcTRTg0VCLKhVJK/B7LqW63Ztx+1XwRKcK+x0Tk urIZHFhUdwbK8BEuhhFOJj5JBGOMnVO7qJDEpn7YJL2mZ0Qd4KiaC/nbeCkHbA82KMjm HFirJFMrJ4dFt5s9/Q6rQXXw9+/XihqhFC3loaGIQW0sJGyvfrQd+8ORaAF6PpsNpAsF QAcg== X-Forwarded-Encrypted: i=1; AHgh+Rq5B3a0VVK4vtje0nIc7AEQuq4CpPhe5Kzxh1mASBrdkGcNGpiONMVJzJ/R8hu2HnMo9shWZLtka48WVtI=@vger.kernel.org X-Gm-Message-State: AOJu0YxwuQfZGczZqukCZ+EYsKPNKnGWpXY+FaEFdheFpF9BdNxI8e1Z 3+a7xp77SFUOC1s9JVWG3dE3BuDU9kF1mDtqTYWM8EqX6zb7RC7LQ9bD X-Gm-Gg: AfdE7cnEQWnl+pHJRwq7tHC2gjj1PxPLyyGJxsT1+Ge7bHP8/MwSSkhkpfHo0R2toHC XN09HZaAgbkQBgvQ34opbMxnCefozx44jjMaemQkXfDud6ZEGABUb2XZguF/GVluHw5CcIvExru CyXe35QVyQjpUDaDQdPs0Rnqf/NpB9LPT/7pCnwHqrIe0WDhH7xp7GCtMekDmk5oT9VFoOpTXcG yEEzYgqkeB+zI+xmdNydy6XV13ui2cwErd9gr8jMAyozNpPPFnwHOnjZ2VNXrALnqvZEtn6jpmu xiUzuTNhYIoadeLyBb+ODugJJYUMGIv/ivvSGws0nhkYDaLK4XjIEBHK1PhGI8YukXIeRwrnarC 28SkfAFYvAv3T8x6JkQPWlTWcSqP2UuAw6ULwAJxD+BBbI6DpsFvRAAiq0qYoOhePDBFe4euICL S+J1LMOIfbdPvyWVk5AmTppV0GO5eZbwbADevtUJzRkmao/I3Rtsp4a2zAaRik05FLPHUs3Ocl7 2Y6oAEKtw== X-Received: by 2002:a05:620a:d8e:b0:92b:6805:917a with SMTP id af79cd13be357-92ef2c135d5mr363868585a.66.1783782375630; Sat, 11 Jul 2026 08:06:15 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5d68e5fsm464578285a.43.2026.07.11.08.06.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 08:06:14 -0700 (PDT) From: Michael Bommarito To: Miri Korenblit , Johannes Berg Cc: Emmanuel Grumbach , Benjamin Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 2/2] wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds Date: Sat, 11 Jul 2026 11:06:11 -0400 Message-ID: <20260711150611.2913332-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260711150611.2913332-1-michael.bommarito@gmail.com> References: <20260711150611.2913332-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add KUnit coverage for a malformed BA-window notification carrying an out-of-range station ID, plus a valid-ID/null-station path to exercise the adjacent non-bug branch. With UBSAN bounds enabled, the malformed case reports an array-index-out-of-bounds splat before the fix and passes after it. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- .../wireless/intel/iwlwifi/mvm/tests/Makefile | 2 +- .../intel/iwlwifi/mvm/tests/window-status.c | 77 +++++++++++++++++++ 2 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-sta= tus.c diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile b/driver= s/net/wireless/intel/iwlwifi/mvm/tests/Makefile index 2267be4cfb441..bf22750fceafc 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile @@ -1,3 +1,3 @@ -iwlmvm-tests-y +=3D module.o hcmd.o +iwlmvm-tests-y +=3D module.o hcmd.o window-status.o =20 obj-$(CONFIG_IWLWIFI_KUNIT_TESTS) +=3D iwlmvm-tests.o diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c b= /drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c new file mode 100644 index 0000000000000..06807e2bdbc12 --- /dev/null +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c @@ -0,0 +1,77 @@ +// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause +/* + * KUnit tests for MVM BA window status notification handling + */ +#include +#include + +#include +#include "../fw-api.h" +#include "../mvm.h" + +MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING"); + +static void iwl_mvm_test_window_status(struct kunit *test, u8 sta_id) +{ + struct iwl_ba_window_status_notif notif =3D {}; + struct iwl_rx_cmd_buffer rxb =3D { + ._offset =3D 0, + ._rx_page_order =3D 0, + }; + struct iwl_rx_packet *pkt; + struct iwl_fw *fw; + struct iwl_mvm *mvm; + u16 ratid; + + BUILD_BUG_ON((IWL_STATION_COUNT_MAX + 1) > + (BA_WINDOW_STATUS_STA_ID_MSK >> + BA_WINDOW_STATUS_STA_ID_POS)); + + mvm =3D kunit_kzalloc(test, sizeof(*mvm), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, mvm); + + fw =3D kunit_kzalloc(test, sizeof(*fw), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, fw); + fw->ucode_capa.num_stations =3D IWL_STATION_COUNT_MAX; + mvm->fw =3D fw; + + rxb._page =3D alloc_page(GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, rxb._page); + + ratid =3D BA_WINDOW_STATUS_VALID_MSK | + (sta_id << BA_WINDOW_STATUS_STA_ID_POS); + notif.ra_tid[0] =3D cpu_to_le16(ratid); + notif.mpdu_rx_count[0] =3D cpu_to_le16(1); + + pkt =3D rxb_addr(&rxb); + memset(pkt, 0, PAGE_SIZE); + pkt->len_n_flags =3D cpu_to_le32(sizeof(pkt->hdr) + sizeof(notif)); + memcpy(pkt->data, ¬if, sizeof(notif)); + + iwl_mvm_window_status_notif(mvm, &rxb); + + __free_page(rxb._page); +} + +static void test_ba_window_status_station_id_bounds(struct kunit *test) +{ + iwl_mvm_test_window_status(test, IWL_STATION_COUNT_MAX + 1); +} + +static void test_ba_window_status_valid_empty_station(struct kunit *test) +{ + iwl_mvm_test_window_status(test, 0); +} + +static struct kunit_case window_status_cases[] =3D { + KUNIT_CASE(test_ba_window_status_station_id_bounds), + KUNIT_CASE(test_ba_window_status_valid_empty_station), + {}, +}; + +static struct kunit_suite window_status =3D { + .name =3D "iwlmvm-window-status", + .test_cases =3D window_status_cases, +}; + +kunit_test_suite(window_status); --=20 2.53.0