kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/wireless/broadcom
History
Tristan Madani a035766f97 wifi: b43legacy: enforce bounds check on firmware key index in RX path 
Same fix as b43: the firmware-controlled key index in b43legacy_rx()
can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is
non-enforcing in production builds, allowing an out-of-bounds read of
dev->key[].

Make the check enforcing by dropping the frame for invalid indices.

Fixes: 75388acd0c ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260417111145.2694196-2-tristmd@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
History 2026-04-27 12:39:57 +02:00
..
b43 wifi: b43: enforce bounds check on firmware key index in b43_rx() 2026-04-27 12:39:57 +02:00
b43legacy wifi: b43legacy: enforce bounds check on firmware key index in RX path 2026-04-27 12:39:57 +02:00
brcm80211 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task 2026-04-27 12:37:54 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00