From nobody Sat Sep 26 18:53:53 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1713F441638; Mon, 31 Aug 2026 13:38:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788183514; cv=none; b=E7ri5/t6xMVfiVsplWkZ2FXGv5NLaWoixLoRJrjuPayiZQ6ZreqfuHGJHmtiXo6UvgPnuqKnvF7cJbpao/rVVIAcafLHn3ILVnosmQmCC0//gO2O1fBM3z637kKf/6hHhDWVg4JCxOIj9MLRK8USFRAlsjtH4/ywfUW2WHlr/hE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788183514; c=relaxed/simple; bh=vkzjvcfVOuU9CfoH9pSbPF3ZMRBrTjtnmjiEgS+KVoQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=G/d8B1rgVveaxuuqjFUHyykEbQmbgEh5NHPHk3J7g9B/21r3qcs+LLKW8VPIN2zlykb9HBnQww0TwWTb4N4xP4Bb4BjbovheCaWzSBI38ao7tDg/2JGEFvXIPETO5QJa74dBdVXtj9uHh3KK+KOave0mfCAh9LQGlAkqtrdtXKU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RENWGPik; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RENWGPik" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B21EF1F00ACF; Mon, 31 Aug 2026 13:38:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788183511; bh=VG40jkJfT/mfWU5YClkiIfIvVi7DZ27PT6hNxwmHfaw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RENWGPikzrameTPXDJ3W08SduHEMqQrOTVvnjsxKuE3dSpI9c/z1pdJlyVzwzwruD /ulb9S45TQWJrJk8eQvO3wB1HWLTqv269kVANwzEbNv3nKtmXcCCdVj6GKSpwzRkxp X82TZzuuhnZ5OTXd5Jx01RnfjzgjKAAFS02h/k/hvpuTB6bK7GZNxOjIYyN77XK/7R Ws1yq+UiVTAPKU26i+RejT5jSo2OvCznJa2RROkpEFVoXzi8h7LDV/Hb2Y60C88kQu YnyVyfueBOp/W2zUsKHRuU/aDneNQ1XNyIOBkQhY1lZAT/o/Sn+mWm+ncuaoBYNH7e Yu4oNzdSoQthQ== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Emmanuel Grumbach , Miri Korenblit , Sasha Levin , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH AUTOSEL 6.18-6.12] wifi: iwlwifi: mvm: validate mac_link_id in session protect notif Date: Mon, 31 Aug 2026 09:22:48 -0400 Message-ID: <20260831133314.4125787-140-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260831133314.4125787-1-sashal@kernel.org> References: <20260831133314.4125787-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.18.48 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Emmanuel Grumbach [ Upstream commit 71245daf7d58a3c407c7e1422facce13ff6a584b ] Check the mac_id before accessing the vif_id_to_mac array. Assisted-by: GitHubCopilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20260714141909.547ea470e686.I931445ae6f37bf0= e1ef6f112c811712fc48af9c9@changeid Signed-off-by: Miri Korenblit Signed-off-by: Sasha Levin --- LLM Generated explanations, may be completely bogus: # Stable Backport Analysis: `wifi: iwlwifi: mvm: validate mac_link_id in session protect notif` **Local tree:** Linux **6.18.44** (`v6.18.44-1-g2736c32da98b9`, `VERSION=3D6 PATCHLEVEL=3D18 SUBLEVEL=3D44`) --- ## PHASE 1: COMMIT MESSAGE FORENSICS ### Step 1.1: Subject line **Record:** `[wifi: iwlwifi: mvm]` `[validate]` =E2=80=94 Add bounds valida= tion for `mac_link_id` in the session protection firmware notification handler before indexing `vif_id_to_mac`. ### Step 1.2: Tags **Record:** - **Assisted-by:** GitHubCopilot:gpt-5.3-codex - **Signed-off-by:** Emmanuel Grumbach \ (iwlwifi maintainer) - **Link:** https://patch.msgid.link/20260714141909.547ea470e686.I931445 ae6f37bf0e1ef6f112c811712fc48af9c9@changeid - **Signed-off-by:** Miri Korenblit \ - **No** Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Acked-by:, or Cc: stable tags - **Notable:** Maintainer-authored; no fuzzer or user bug report cited ### Step 1.3: Body **Record:** - **Bug:** `mac_link_id` from firmware is used to index `vif_id_to_mac` without validating it first. - **Symptom:** Not explicitly stated (no crash trace); implied mis- handling of invalid firmware notification. - **Root cause (from code):** `mac_link_id` is read as a 32-bit value into an `int`, then passed to `iwl_mvm_rcu_dereference_vif_id()` which takes `u8`. Values =E2=89=A5 256 truncate modulo 256 and can map to valid indices 0=E2=80=933, bypassing the helper=E2=80=99s `WARN_ON` bounds chec= k. ### Step 1.4: Hidden bug fix? **Record:** Yes. Despite the terse message, this is a real logic/safety bug fix, not cosmetic cleanup. It mirrors an existing pattern in `rxmq.c` for the same array. --- ## PHASE 2: DIFF ANALYSIS ### Step 2.1: Inventory **Record:** - **File:** `drivers/net/wireless/intel/iwlwifi/mvm/time-event.c` (+5 lines) - **Function:** `iwl_mvm_rx_session_protect_notif()` - **Scope:** Single-file, surgical fix ### Step 2.2: Code flow change **Record:** - **Before:** `id =3D le32_to_cpu(notif->mac_link_id)` =E2=86=92 immediate `iwl_mvm_rcu_dereference_vif_id(mvm, id, true)` (implicit `int` =E2=86=92= `u8` truncation). - **After:** `IWL_FW_CHECK` on full `int id` against `ARRAY_SIZE(mvm->vif_id_to_mac)` (4); early return if invalid; then existing lookup proceeds. - **Path:** Firmware RX notification handler (`SESSION_PROTECTION_NOTIF`), normal runtime path during association/session protection. ### Step 2.3: Bug mechanism **Record:** **Logic / bounds-check bypass via type truncation.** `NUM_MAC_INDEX_DRIVER` =3D 4, so valid indices are 0=E2=80=933: ```15:16:drivers/net/wireless/intel/iwlwifi/fw/api/mac.h #define NUM_MAC_INDEX_DRIVER MAC_INDEX_AUX #define NUM_MAC_INDEX (NUM_MAC_INDEX_DRIVER + 1) ``` `iwl_mvm_rcu_dereference_vif_id()` only checks the truncated `u8`: ```1384:1391:drivers/net/wireless/intel/iwlwifi/mvm/mvm.h static inline struct ieee80211_vif * iwl_mvm_rcu_dereference_vif_id(struct iwl_mvm *mvm, u8 vif_id, bool rcu) { if (WARN_ON(vif_id >=3D ARRAY_SIZE(mvm->vif_id_to_mac))) return NULL; ``` Example: `mac_link_id =3D 256` =E2=86=92 `u8` =3D 0 =E2=86=92 passes check = =E2=86=92 wrong VIF at index 0. Values 4=E2=80=93255 are caught; values =E2=89=A5 256 congruent to= 0=E2=80=933 mod 256 are not. Downstream effects in `iwl_mvm_rx_session_protect_notif()` include modifying the wrong interface=E2=80=99s `time_event_data`, calling `iwl_mvm_te_check_disconnect()` on the wrong VIF, and corrupting P2P ROC state. ### Step 2.4: Fix quality **Record:** Obviously correct; matches existing driver pattern in `rxmq.c`: ```2618:2623:drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c /* >=3D means AUX MAC/link ID, no energy correction needed then */ if (IWL_FW_CHECK(mvm, id >=3D ARRAY_SIZE(mvm->vif_id_to_mac), "invalid link ID %d\n", id)) return; vif =3D iwl_mvm_rcu_dereference_vif_id(mvm, id, false); ``` **Regression risk:** Very low =E2=80=94 early return only on invalid firmwa= re input; no API or locking changes. --- ## PHASE 3: GIT HISTORY INVESTIGATION ### Step 3.1: Blame **Record:** `iwl_mvm_rx_session_protect_notif()` exists at lines 953=E2=80=931025 in this tree. Blame attributes lines to merge commit `5d324e5159d9e` (shallow history for this file). Function and handler registration in `ops.c` are present in 6.18.44. ### Step 3.2: Fixes: tag **Record:** N/A =E2=80=94 no Fixes: tag in commit message. ### Step 3.3: Related file history **Record:** `git log --oneline -20 -- time-event.c` returns only the usb merge commit (limited per-file history in this checkout). The beacon- filter validation in `rxmq.c` at line 2619 establishes precedent for this exact check pattern. ### Step 3.4: Author context **Record:** Emmanuel Grumbach is iwlwifi maintainer. Miri Korenblit is an active iwlwifi contributor. High credibility for driver correctness. ### Step 3.5: Dependencies **Record:** Standalone; no series or prerequisite commits. Uses existing `IWL_FW_CHECK` macro from `fw/dbg.h`. No new structures or APIs. --- ## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH ### Step 4.1: Original discussion **Record:** `b4 dig` on HEAD did not match this patch. Link URL and lore.kernel.org blocked by Anubis bot protection =E2=80=94 could not read thread. **UNVERIFIED:** reviewer feedback and stable nominations. ### Step 4.2: Reviewers **Record:** **UNVERIFIED** =E2=80=94 `b4 dig -w` not run (no commit hash available in this evaluation context). ### Step 4.3: Bug report **Record:** No Reported-by or syzbot link. Bug inferred from code analysis and driver consistency with `rxmq.c`. ### Step 4.4: Related patches **Record:** Same validation pattern exists for beacon filter notifications in `rxmq.c`. This commit closes a gap in `time-event.c` where `IWL_FW_CHECK` is currently absent. ### Step 4.5: Stable list **Record:** **UNVERIFIED** =E2=80=94 lore stable search blocked. --- ## PHASE 5: CODE SEMANTIC ANALYSIS ### Step 5.1: Key functions **Record:** `iwl_mvm_rx_session_protect_notif()` (modified); uses `iwl_mvm_rcu_dereference_vif_id()`, `iwl_mvm_te_check_disconnect()`, `iwl_mvm_te_clear_data()`, `ieee80211_ready_on_channel()` / `ieee80211_remain_on_channel_expired()`. ### Step 5.2: Callers **Record:** Registered in `ops.c` as RX handler for `SESSION_PROTECTION_NOTIF` under `MAC_CONF_GROUP` =E2=80=94 invoked on every session-protection firmware notification for Intel MVM devices. ### Step 5.3: Callees **Record:** RCU lookup, spinlocks on `time_event_lock`, mac80211 callbacks. Invalid ID can corrupt another interface=E2=80=99s session-prote= ction / ROC state. ### Step 5.4: Reachability **Record:** Triggered by iwlwifi firmware notifications during WiFi association, session protection, and P2P ROC. Reachable during normal WiFi use on Intel hardware (`CONFIG_IWLMVM`). ### Step 5.5: Similar patterns **Record:** `rxmq.c` lines 272=E2=80=93273 and 2619=E2=80=932621 already va= lidate before `vif_id_to_mac` access. `time-event.c` is the outlier lacking this check. --- ## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE ### Step 6.1: Buggy code present? **Record:** **Yes.** Current `time-event.c` at lines 958=E2=80=93965 has no `IWL_FW_CHECK`; passes raw `int id` directly to `iwl_mvm_rcu_dereference_vif_id()`. Fix is **not** yet applied in 6.18.44. ### Step 6.2: Backport complications **Record:** Clean apply expected =E2=80=94 5-line insertion before `rcu_read_lock()`. No conflicting changes observed. `IWL_FW_CHECK` and `vif_id_to_mac` already exist in this tree. ### Step 6.3: Related fixes already present? **Record:** Beacon-filter path in `rxmq.c` already has this validation. No duplicate fix for session-protect in this tree (`grep` found no "Invalid mac_link_id" string). --- ## PHASE 7: SUBSYSTEM CONTEXT ### Step 7.1: Subsystem criticality **Record:** `drivers/net/wireless/intel/iwlwifi/mvm` =E2=80=94 **IMPORTANT** (Intel WiFi, widely deployed on laptops/desktops). ### Step 7.2: Activity **Record:** iwlwifi actively maintained; MLD path added alongside legacy MVM. This fix targets the MVM notification path still used by many devices in 6.18.y. --- ## PHASE 8: IMPACT AND RISK ### Step 8.1: Who is affected **Record:** Users of Intel WiFi with MVM driver (`CONFIG_IWLMVM=3Dy/m`), during session protection / association / P2P ROC. ### Step 8.2: Trigger conditions **Record:** Firmware sends `SESSION_PROTECTION_NOTIF` with `mac_link_id` =E2=89=A5 4, or =E2=89=A5 256 with value mod 256 in 0=E2=80=933. Requires f= irmware misbehavior or edge-case firmware state =E2=80=94 not everyday, but plausible and not u= ser- privilege-dependent. ### Step 8.3: Failure mode severity **Record:** Wrong-interface session-protection state corruption; possible spurious disconnect (`iwl_mvm_te_check_disconnect`) or ROC misbehavior on an unrelated VIF. **Severity: MEDIUM=E2=80=93HIGH** (functio= nal WiFi breakage, not kernel oops, but user-visible connectivity impact). ### Step 8.4: Risk=E2=80=93benefit **Record:** - **Benefit:** Prevents cross-interface state corruption from invalid firmware notifications; aligns with existing driver defensive pattern. - **Risk:** Very low =E2=80=94 5 lines, early return on invalid input only. - **Ratio:** Favorable for stable. --- ## PHASE 9: FINAL SYNTHESIS ### Step 9.1: Evidence summary **FOR backport:** - Real bug: `int`=E2=86=92`u8` truncation bypasses bounds checking for `vif_id_to_mac` - Wrong VIF can be operated on (disconnect, time-event corruption) - Small, surgical, maintainer-authored fix - Matches established pattern in same driver (`rxmq.c`) - Buggy code confirmed present in Linux 6.18.44; fix not yet applied - No new APIs or features **AGAINST backport:** - No explicit crash report, syzbot, or user Reported-by - Commit message is minimal - Trigger requires invalid firmware `mac_link_id` (not proven in the wild from available sources) **UNRESOLVED:** - Mailing list review discussion (lore blocked) - Whether a specific production firmware bug motivated this fix ### Step 9.2: Stable rules checklist | Criterion | Result | |-----------|--------| | 1. Obviously correct and tested? | **PASS** =E2=80=94 matches existing `rxmq.c` pattern; maintainer SOB | | 2. Fixes a real bug? | **PASS** =E2=80=94 truncation bypass is verifiable= in code | | 3. Important issue? | **PASS** =E2=80=94 wrong-interface WiFi state corru= ption / disconnect | | 4. Small and contained? | **PASS** =E2=80=94 5 lines, one function | | 5. No new features/APIs? | **PASS** | | 6. Can apply to local tree? | **PASS** =E2=80=94 code exists; clean apply expected | ### Step 9.3: Exception categories **Record:** N/A (not device ID, quirk, DT, build, or docs =E2=80=94 standard driver bug fix). ### Step 9.4: Decision rationale For **this** tree (6.18.44), the vulnerable code is present and the fix is a minimal, obviously-correct defensive validation that prevents wrong-interface state corruption when firmware sends an out-of-range `mac_link_id`. It follows an established iwlwifi pattern and carries negligible regression risk. --- ## Verification - **[Phase 1]** Parsed subject, tags, body from user-provided commit message - **[Phase 2]** Read `time-event.c` lines 953=E2=80=931025: fix absent, vulnerable code confirmed - **[Phase 2]** Read `mvm.h` lines 1384=E2=80=931394: `u8` parameter + `WAR= N_ON` only on truncated value - **[Phase 2]** Read `mac.h` line 15: `NUM_MAC_INDEX_DRIVER =3D 4` - **[Phase 2]** Read `rxmq.c` lines 2618=E2=80=932623: identical validation pattern exists - **[Phase 2]** Read `fw/dbg.h` lines 334=E2=80=93342: `IWL_FW_CHECK` logs = and returns condition - **[Phase 3]** `git describe HEAD`: v6.18.44-1-g2736c32da98b9 - **[Phase 3]** `git blame -L 953,970 time-event.c`: function present in tree - **[Phase 3]** `grep IWL_FW_CHECK time-event.c`: no matches (fix not present) - **[Phase 4]** `b4 dig -c HEAD`: no match for this patch - **[Phase 4]** WebFetch patch.msgid.link and lore.kernel.org: blocked by Anubis =E2=80=94 **UNVERIFIED** - **[Phase 5]** `grep iwl_mvm_rx_session_protect_notif`: handler in `ops.c` line 355 - **[Phase 5]** `grep iwl_mvm_rcu_dereference_vif_id mvm/`: multiple call sites; `time-event.c` lacks pre-check - **[Phase 6]** Confirmed buggy code at lines 958=E2=80=93965 without `IWL_FW_CHECK` - **[Phase 6]** `grep "Invalid mac_link_id"`: no results (fix not applied) - **[Phase 8]** Traced downstream effects: `iwl_mvm_te_check_disconnect`, ROC callbacks on wrong VIF --- **YES**Two background git history lookups (`git log -S` for when `iwl_mvm_rx_session_protect_notif` was introduced, and a repo-depth check) timed out and were killed =E2=80=94 likely due to the large tree and= the accidental `--all` on one of them. That didn=E2=80=99t change the backport verdict: the vulnerable code is pre= sent in this 6.18.44 tree, the fix is a 5-line bounds check matching an existing `rxmq.c` pattern, and the analysis already concluded **YES**. drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/= net/wireless/intel/iwlwifi/mvm/time-event.c index 1a3a8a3f0fb49..356f68f5e6ac3 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c @@ -960,6 +960,11 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *= mvm, struct ieee80211_vif *vif; struct iwl_mvm_vif *mvmvif; =20 + if (IWL_FW_CHECK(mvm, id >=3D ARRAY_SIZE(mvm->vif_id_to_mac), + "Invalid mac_link_id (%d) in session protect notif\n", + id)) + return; + rcu_read_lock(); =20 /* note we use link ID =3D=3D MAC ID */ --=20 2.53.0