Re: [PATCH] brcmfmac: validate bsscfg indices in IF events

Arend van Spriel <[email protected]> Sat, 28 Mar 2026 20:32:48 +0100

Newsgroups	dev.linux.lists.brcm80211,org.kernel.vger.linux-kernel,org.kernel.vger.linux-wireless
Message-ID	<[email protected]>

On 23/03/2026 08:45, Pengpeng Hou wrote:
> brcmf_fweh_handle_if_event() validates the firmware-provided interface
> index before it touches drvr->iflist[], but it still uses the raw
> bsscfgidx field as an array index without a matching range check.
> 
> Reject IF events whose bsscfg index does not fit in drvr->iflist[]
> before indexing the interface array.

Acked-by: Arend van Spriel <[email protected]>

> Signed-off-by: Pengpeng Hou <[email protected]>
> ---
>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 +++++
>   1 file changed, 5 insertions(+)