Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx()

--===============0901829195834179257==
Content-Type: multipart/signed; boundary="Sig_//0vg=Mq815_JCc8zFztXnZk";
 protocol="application/pgp-signature"; micalg=pgp-sha512

--Sig_//0vg=Mq815_JCc8zFztXnZk
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, 16 Apr 2026 08:34:11 +0200
Jonas Gorski <[email protected]> wrote:
> > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wir=
eless/broadcom/b43/xmit.c
> > index XXXXXXX..XXXXXXX 100644
> > --- a/drivers/net/wireless/broadcom/b43/xmit.c
> > +++ b/drivers/net/wireless/broadcom/b43/xmit.c
> > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff =
*skb, const void *_rxhdr)
> >                  */
> >                 keyidx =3D b43_kidx_to_raw(dev, keyidx);
> > -               B43_WARN_ON(keyidx >=3D ARRAY_SIZE(dev->key));
> > +               if (keyidx >=3D ARRAY_SIZE(dev->key)) {
> > +                       b43dbg(dev->wl, "RX: invalid key index %u\n", k=
eyidx);
> > +                       goto drop;
> > +               } =20
>=20
> B43_WARN_ON() returns the condition's result, so if you keep it you
> can shorten this to
>=20
> if (B43_WARN_ON(keyidx >=3D ARRAY_SIZE(dev->key)))
>         goto drop;

Acked-by: Michael B=C3=BCsch <[email protected]>

Please also check the b43legacy driver. It may contain exactly the same cod=
e.

--=20
Michael B=C3=BCsch
https://bues.ch/

--Sig_//0vg=Mq815_JCc8zFztXnZk
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEihRzkKVZOnT2ipsS9TK+HZCNiw4FAmnhD+oACgkQ9TK+HZCN
iw4+gA/9Ff2iU8x3O005D+JjdnNz/4hJt9UxhdmH+177BDDCD9R4F7nsEKqynN+1
cecA+FYiPkR8LeaesdIjK9FiI3mVilHKPEBNJzRRzCld+mvkOQXQBJ+ElshKXVZW
oc1g5tBlIs16vZjzdBnSagJNrkwV1jKxLwvSjgGdIGhh15nIGZkBO+ZydIpSEUUY
/83voqDUPsQuLx8OyQpuf6ehmpe//vuTBN79CuNhFN/V6Aja96Lz10LgzfmUYaW4
Wti6/HL83pEeWaBGbFJMOFisgJrHbbsJlZphKRI/FqV7+Mj0Mr7euRmg+jE3W5Tu
lzC13gB3FKIy0Mqq8gwwDVrQllHZ9bvkWBAcXy6mWoc7rZrRqB08pR6F+Sfnsrrc
7nvk7q+2RknOPOr6vMNnu4wksXsMoL99UGN8u7ux6Wb7hGmuPO7dLveyUe6yzWdc
0nv9YBjOH64sItAfDIovpX4meEU32uvP/BDk9cMl7QcyuCTzg1Mkh9c6ksBP9b/z
+eYdx7H+qeopuEZ+o4PymRV2uoMzryQKTFaEP1icjBPgwVCMD4KrPslPopb2yase
99k04lggNYkCnrH6QF4+gIEBSwj24Bt8sveFcnOCb94vEakXLWLN313ZOjhhC8a2
mV6IQq6EwQJcy+LE+mHd+Ew6HkFFCg9TXvvvm7+rA/4bYj1PKaE=
=0xKO
-----END PGP SIGNATURE-----

--Sig_//0vg=Mq815_JCc8zFztXnZk--


--===============0901829195834179257==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
b43-dev mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/b43-dev

--===============0901829195834179257==--