wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Wed, 15 Jul 2026 18:57:11 +0000 (21:57 +0300)
committerMiri Korenblit <miriam.rachel.korenblit@intel.com>
Thu, 16 Jul 2026 18:12:19 +0000 (21:12 +0300)
commit94d3982806c7f194b23484befde12934dda23064
treec4d38c823424be9b4ab7394c27c0d80cd4ec926b
parent7b271df210848e8d0dd9c0d7b032050b3f3affbf
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of
the actual TID value 'tid'. This writes lq_color into a random tid_data
slot unrelated to the BA entry.
Since multi-TID blockack is not really in use, 'i' was always 0 and no
harm was done.
Add a out-of-bound check before accessing the array.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.919edee567eb.Ie85c350e3afe2b39709d0039072740d86660f8ae@changeid
drivers/net/wireless/intel/iwlwifi/mvm/tx.c