* [PATCH v2 0/2] wifi: b43: fix OOB read and infinite loop from hardware-reported values @ 2026-04-15 22:24 ` Tristan Madani 0 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> Hi Johannes, Note: this is a v2 resubmission. The original was sent via Gmail which caused HTML rendering issues. This version uses git send-email for proper plain-text formatting. Two issues in b43 where hardware-reported values are used without bounds checking: Proposed fixes in the following patches. Thanks, Tristan _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v2 0/2] wifi: b43: fix OOB read and infinite loop from hardware-reported values @ 2026-04-15 22:24 ` Tristan Madani 0 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> Hi Johannes, Note: this is a v2 resubmission. The original was sent via Gmail which caused HTML rendering issues. This version uses git send-email for proper plain-text formatting. Two issues in b43 where hardware-reported values are used without bounds checking: Proposed fixes in the following patches. Thanks, Tristan ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot 2026-04-15 22:24 ` Tristan Madani @ 2026-04-15 22:24 ` Tristan Madani -1 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> b43_dma_rx() reads current_slot from hardware via get_current_rxslot(). If the value is >= ring->nr_slots, the B43_WARN_ON only warns but continues. The for loop then never terminates because next_slot() wraps modulo nr_slots and can never reach the out-of-range current_slot. Replace the B43_WARN_ON with an explicit bounds check that returns early when the hardware reports an invalid slot index. Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> --- drivers/net/wireless/broadcom/b43/dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/broadcom/b43/dma.c +++ b/drivers/net/wireless/broadcom/b43/dma.c @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) B43_WARN_ON(ring->tx); current_slot = ops->get_current_rxslot(ring); - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { + B43_WARN_ON(1); + return; + } slot = ring->current_slot; for (; slot != current_slot; slot = next_slot(ring, slot)) { -- 2.43.0 _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot @ 2026-04-15 22:24 ` Tristan Madani 0 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> b43_dma_rx() reads current_slot from hardware via get_current_rxslot(). If the value is >= ring->nr_slots, the B43_WARN_ON only warns but continues. The for loop then never terminates because next_slot() wraps modulo nr_slots and can never reach the out-of-range current_slot. Replace the B43_WARN_ON with an explicit bounds check that returns early when the hardware reports an invalid slot index. Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> --- drivers/net/wireless/broadcom/b43/dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/broadcom/b43/dma.c +++ b/drivers/net/wireless/broadcom/b43/dma.c @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) B43_WARN_ON(ring->tx); current_slot = ops->get_current_rxslot(ring); - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { + B43_WARN_ON(1); + return; + } slot = ring->current_slot; for (; slot != current_slot; slot = next_slot(ring, slot)) { -- 2.43.0 ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot 2026-04-15 22:24 ` Tristan Madani @ 2026-04-16 6:34 ` Jonas Gorski -1 siblings, 0 replies; 14+ messages in thread From: Jonas Gorski @ 2026-04-16 6:34 UTC (permalink / raw) To: Tristan Madani; +Cc: Johannes Berg, linux-wireless, b43-dev, linux-kernel Hi, On Thu, Apr 16, 2026 at 12:24 AM Tristan Madani <tristmd@gmail.com> wrote: > > From: Tristan Madani <tristan@talencesecurity.com> > > b43_dma_rx() reads current_slot from hardware via get_current_rxslot(). > If the value is >= ring->nr_slots, the B43_WARN_ON only warns but > continues. The for loop then never terminates because next_slot() wraps > modulo nr_slots and can never reach the out-of-range current_slot. > > Replace the B43_WARN_ON with an explicit bounds check that returns > early when the hardware reports an invalid slot index. > > Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") > Signed-off-by: Tristan Madani <tristan@talencesecurity.com> > --- > drivers/net/wireless/broadcom/b43/dma.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c > index XXXXXXX..XXXXXXX 100644 > --- a/drivers/net/wireless/broadcom/b43/dma.c > +++ b/drivers/net/wireless/broadcom/b43/dma.c > @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) > B43_WARN_ON(ring->tx); > current_slot = ops->get_current_rxslot(ring); > - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); > + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { > + B43_WARN_ON(1); > + return; > + } B43_WARN_ON() returns the condition's result, so you can shorten this to if (B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots))) return; Best regards, Jonas _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot @ 2026-04-16 6:34 ` Jonas Gorski 0 siblings, 0 replies; 14+ messages in thread From: Jonas Gorski @ 2026-04-16 6:34 UTC (permalink / raw) To: Tristan Madani; +Cc: Johannes Berg, linux-wireless, b43-dev, linux-kernel Hi, On Thu, Apr 16, 2026 at 12:24 AM Tristan Madani <tristmd@gmail.com> wrote: > > From: Tristan Madani <tristan@talencesecurity.com> > > b43_dma_rx() reads current_slot from hardware via get_current_rxslot(). > If the value is >= ring->nr_slots, the B43_WARN_ON only warns but > continues. The for loop then never terminates because next_slot() wraps > modulo nr_slots and can never reach the out-of-range current_slot. > > Replace the B43_WARN_ON with an explicit bounds check that returns > early when the hardware reports an invalid slot index. > > Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") > Signed-off-by: Tristan Madani <tristan@talencesecurity.com> > --- > drivers/net/wireless/broadcom/b43/dma.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c > index XXXXXXX..XXXXXXX 100644 > --- a/drivers/net/wireless/broadcom/b43/dma.c > +++ b/drivers/net/wireless/broadcom/b43/dma.c > @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) > B43_WARN_ON(ring->tx); > current_slot = ops->get_current_rxslot(ring); > - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); > + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { > + B43_WARN_ON(1); > + return; > + } B43_WARN_ON() returns the condition's result, so you can shorten this to if (B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots))) return; Best regards, Jonas ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot 2026-04-16 6:34 ` Jonas Gorski @ 2026-04-16 16:31 ` Michael Büsch -1 siblings, 0 replies; 14+ messages in thread From: Michael Büsch @ 2026-04-16 16:31 UTC (permalink / raw) To: Jonas Gorski Cc: Tristan Madani, Johannes Berg, linux-wireless, b43-dev, linux-kernel [-- Attachment #1.1: Type: text/plain, Size: 1066 bytes --] On Thu, 16 Apr 2026 08:34:00 +0200 Jonas Gorski <jonas.gorski@gmail.com> wrote: > > diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c > > index XXXXXXX..XXXXXXX 100644 > > --- a/drivers/net/wireless/broadcom/b43/dma.c > > +++ b/drivers/net/wireless/broadcom/b43/dma.c > > @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) > > B43_WARN_ON(ring->tx); > > current_slot = ops->get_current_rxslot(ring); > > - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); > > + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { > > + B43_WARN_ON(1); > > + return; > > + } > > B43_WARN_ON() returns the condition's result, so you can shorten this to > > if (B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots))) > return; Acked-by: Michael Büsch <m@bues.ch> Please also check the b43legacy driver. It may contain exactly the same code. -- Michael Büsch https://bues.ch/ [-- Attachment #1.2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 833 bytes --] [-- Attachment #2: Type: text/plain, Size: 149 bytes --] _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot @ 2026-04-16 16:31 ` Michael Büsch 0 siblings, 0 replies; 14+ messages in thread From: Michael Büsch @ 2026-04-16 16:31 UTC (permalink / raw) To: Jonas Gorski Cc: Tristan Madani, Johannes Berg, linux-wireless, b43-dev, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1066 bytes --] On Thu, 16 Apr 2026 08:34:00 +0200 Jonas Gorski <jonas.gorski@gmail.com> wrote: > > diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c > > index XXXXXXX..XXXXXXX 100644 > > --- a/drivers/net/wireless/broadcom/b43/dma.c > > +++ b/drivers/net/wireless/broadcom/b43/dma.c > > @@ -1693,7 +1693,10 @@ void b43_dma_rx(struct b43_dmaring *ring) > > B43_WARN_ON(ring->tx); > > current_slot = ops->get_current_rxslot(ring); > > - B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots)); > > + if (!(current_slot >= 0 && current_slot < ring->nr_slots)) { > > + B43_WARN_ON(1); > > + return; > > + } > > B43_WARN_ON() returns the condition's result, so you can shorten this to > > if (B43_WARN_ON(!(current_slot >= 0 && current_slot < ring->nr_slots))) > return; Acked-by: Michael Büsch <m@bues.ch> Please also check the b43legacy driver. It may contain exactly the same code. -- Michael Büsch https://bues.ch/ [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() 2026-04-15 22:24 ` Tristan Madani @ 2026-04-15 22:24 ` Tristan Madani -1 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of 1 byte from struct b43_firmware. A non-zero OOB value causes RX_FLAG_DECRYPTED to be incorrectly set on un-decrypted frames. Replace with an enforcing check that skips the key lookup for invalid indices. Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> --- drivers/net/wireless/broadcom/b43/xmit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/broadcom/b43/xmit.c +++ b/drivers/net/wireless/broadcom/b43/xmit.c @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) */ keyidx = b43_kidx_to_raw(dev, keyidx); - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); + if (keyidx >= ARRAY_SIZE(dev->key)) { + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); + goto drop; + } if (dev->key[keyidx].algorithm != B43_SEC_ALGO_NONE) { wlhdr_len = ieee80211_hdrlen(fctl); _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() @ 2026-04-15 22:24 ` Tristan Madani 0 siblings, 0 replies; 14+ messages in thread From: Tristan Madani @ 2026-04-15 22:24 UTC (permalink / raw) To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel From: Tristan Madani <tristan@talencesecurity.com> The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of 1 byte from struct b43_firmware. A non-zero OOB value causes RX_FLAG_DECRYPTED to be incorrectly set on un-decrypted frames. Replace with an enforcing check that skips the key lookup for invalid indices. Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> --- drivers/net/wireless/broadcom/b43/xmit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/broadcom/b43/xmit.c +++ b/drivers/net/wireless/broadcom/b43/xmit.c @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) */ keyidx = b43_kidx_to_raw(dev, keyidx); - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); + if (keyidx >= ARRAY_SIZE(dev->key)) { + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); + goto drop; + } if (dev->key[keyidx].algorithm != B43_SEC_ALGO_NONE) { wlhdr_len = ieee80211_hdrlen(fctl); ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() 2026-04-15 22:24 ` Tristan Madani @ 2026-04-16 6:34 ` Jonas Gorski -1 siblings, 0 replies; 14+ messages in thread From: Jonas Gorski @ 2026-04-16 6:34 UTC (permalink / raw) To: Tristan Madani; +Cc: Johannes Berg, linux-wireless, b43-dev, linux-kernel Hi, On Thu, Apr 16, 2026 at 12:24 AM Tristan Madani <tristmd@gmail.com> wrote: > > From: Tristan Madani <tristan@talencesecurity.com> > > The firmware-controlled key index in b43_rx() can exceed the dev->key[] > array size (58 entries). The existing B43_WARN_ON is non-enforcing in > production builds, allowing an out-of-bounds read of 1 byte from struct > b43_firmware. A non-zero OOB value causes RX_FLAG_DECRYPTED to be > incorrectly set on un-decrypted frames. > > Replace with an enforcing check that skips the key lookup for invalid > indices. > > Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") > Signed-off-by: Tristan Madani <tristan@talencesecurity.com> > --- > drivers/net/wireless/broadcom/b43/xmit.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c > index XXXXXXX..XXXXXXX 100644 > --- a/drivers/net/wireless/broadcom/b43/xmit.c > +++ b/drivers/net/wireless/broadcom/b43/xmit.c > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) > */ > keyidx = b43_kidx_to_raw(dev, keyidx); > - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); > + if (keyidx >= ARRAY_SIZE(dev->key)) { > + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); > + goto drop; > + } B43_WARN_ON() returns the condition's result, so if you keep it you can shorten this to if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key))) goto drop; Best regards, Jonas _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() @ 2026-04-16 6:34 ` Jonas Gorski 0 siblings, 0 replies; 14+ messages in thread From: Jonas Gorski @ 2026-04-16 6:34 UTC (permalink / raw) To: Tristan Madani; +Cc: Johannes Berg, linux-wireless, b43-dev, linux-kernel Hi, On Thu, Apr 16, 2026 at 12:24 AM Tristan Madani <tristmd@gmail.com> wrote: > > From: Tristan Madani <tristan@talencesecurity.com> > > The firmware-controlled key index in b43_rx() can exceed the dev->key[] > array size (58 entries). The existing B43_WARN_ON is non-enforcing in > production builds, allowing an out-of-bounds read of 1 byte from struct > b43_firmware. A non-zero OOB value causes RX_FLAG_DECRYPTED to be > incorrectly set on un-decrypted frames. > > Replace with an enforcing check that skips the key lookup for invalid > indices. > > Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") > Signed-off-by: Tristan Madani <tristan@talencesecurity.com> > --- > drivers/net/wireless/broadcom/b43/xmit.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c > index XXXXXXX..XXXXXXX 100644 > --- a/drivers/net/wireless/broadcom/b43/xmit.c > +++ b/drivers/net/wireless/broadcom/b43/xmit.c > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) > */ > keyidx = b43_kidx_to_raw(dev, keyidx); > - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); > + if (keyidx >= ARRAY_SIZE(dev->key)) { > + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); > + goto drop; > + } B43_WARN_ON() returns the condition's result, so if you keep it you can shorten this to if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key))) goto drop; Best regards, Jonas ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() 2026-04-16 6:34 ` Jonas Gorski @ 2026-04-16 16:35 ` Michael Büsch -1 siblings, 0 replies; 14+ messages in thread From: Michael Büsch @ 2026-04-16 16:35 UTC (permalink / raw) To: Jonas Gorski Cc: Tristan Madani, Johannes Berg, linux-wireless, b43-dev, linux-kernel [-- Attachment #1.1: Type: text/plain, Size: 1122 bytes --] On Thu, 16 Apr 2026 08:34:11 +0200 Jonas Gorski <jonas.gorski@gmail.com> wrote: > > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c > > index XXXXXXX..XXXXXXX 100644 > > --- a/drivers/net/wireless/broadcom/b43/xmit.c > > +++ b/drivers/net/wireless/broadcom/b43/xmit.c > > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) > > */ > > keyidx = b43_kidx_to_raw(dev, keyidx); > > - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); > > + if (keyidx >= ARRAY_SIZE(dev->key)) { > > + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); > > + goto drop; > > + } > > B43_WARN_ON() returns the condition's result, so if you keep it you > can shorten this to > > if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key))) > goto drop; Acked-by: Michael Büsch <m@bues.ch> Please also check the b43legacy driver. It may contain exactly the same code. -- Michael Büsch https://bues.ch/ [-- Attachment #1.2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 833 bytes --] [-- Attachment #2: Type: text/plain, Size: 149 bytes --] _______________________________________________ b43-dev mailing list b43-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/b43-dev ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() @ 2026-04-16 16:35 ` Michael Büsch 0 siblings, 0 replies; 14+ messages in thread From: Michael Büsch @ 2026-04-16 16:35 UTC (permalink / raw) To: Jonas Gorski Cc: Tristan Madani, Johannes Berg, linux-wireless, b43-dev, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1122 bytes --] On Thu, 16 Apr 2026 08:34:11 +0200 Jonas Gorski <jonas.gorski@gmail.com> wrote: > > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c > > index XXXXXXX..XXXXXXX 100644 > > --- a/drivers/net/wireless/broadcom/b43/xmit.c > > +++ b/drivers/net/wireless/broadcom/b43/xmit.c > > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) > > */ > > keyidx = b43_kidx_to_raw(dev, keyidx); > > - B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)); > > + if (keyidx >= ARRAY_SIZE(dev->key)) { > > + b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx); > > + goto drop; > > + } > > B43_WARN_ON() returns the condition's result, so if you keep it you > can shorten this to > > if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key))) > goto drop; Acked-by: Michael Büsch <m@bues.ch> Please also check the b43legacy driver. It may contain exactly the same code. -- Michael Büsch https://bues.ch/ [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2026-04-16 16:36 UTC | newest] Thread overview: 14+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-04-15 22:24 [PATCH v2 0/2] wifi: b43: fix OOB read and infinite loop from hardware-reported values Tristan Madani 2026-04-15 22:24 ` Tristan Madani 2026-04-15 22:24 ` [PATCH v2 1/2] wifi: b43: fix infinite loop from invalid hardware DMA RX slot Tristan Madani 2026-04-15 22:24 ` Tristan Madani 2026-04-16 6:34 ` Jonas Gorski 2026-04-16 6:34 ` Jonas Gorski 2026-04-16 16:31 ` Michael Büsch 2026-04-16 16:31 ` Michael Büsch 2026-04-15 22:24 ` [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx() Tristan Madani 2026-04-15 22:24 ` Tristan Madani 2026-04-16 6:34 ` Jonas Gorski 2026-04-16 6:34 ` Jonas Gorski 2026-04-16 16:35 ` Michael Büsch 2026-04-16 16:35 ` Michael Büsch
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.