diff options
| author | Tristan Madani <tristan@talencesecurity.com> | 2026-04-17 11:11:44 +0000 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-04-27 12:39:57 +0200 |
| commit | 1f4f78bf8549e6ac4f04fba4176854f3a6e0c332 (patch) | |
| tree | 639e7302104a21a5293321a684775ebeffd7b809 /drivers/net/wireless | |
| parent | c623b63580880cc742255eaed3d79804c1b91143 (diff) | |
| download | linux-next-1f4f78bf8549e6ac4f04fba4176854f3a6e0c332.tar.gz linux-next-1f4f78bf8549e6ac4f04fba4176854f3a6e0c332.zip | |
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Michael Büsch <m@bues.ch>
Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/broadcom/b43/xmit.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c index 7651b1bdb592..f0b082596637 100644 --- a/drivers/net/wireless/broadcom/b43/xmit.c +++ b/drivers/net/wireless/broadcom/b43/xmit.c @@ -702,7 +702,8 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) * key index, but the ucode passed it slightly different. */ keyidx = b43_kidx_to_raw(dev, keyidx); - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); + if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key))) + goto drop; if (dev->key[keyidx].algorithm != B43_SEC_ALGO_NONE) { wlhdr_len = ieee80211_hdrlen(fctl); |