Re: [PATCH v2 2/2] wifi: b43: fix OOB read from hardware key index in b43_rx()

["Michael Büsch" <m@bues.ch>]

[-- Attachment #1: Type: text/plain, Size: 1122 bytes --]

On Thu, 16 Apr 2026 08:34:11 +0200
Jonas Gorski <jonas.gorski@gmail.com> wrote:
> > diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c
> > index XXXXXXX..XXXXXXX 100644
> > --- a/drivers/net/wireless/broadcom/b43/xmit.c
> > +++ b/drivers/net/wireless/broadcom/b43/xmit.c
> > @@ -704,7 +704,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
> >                  */
> >                 keyidx = b43_kidx_to_raw(dev, keyidx);
> > -               B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key));
> > +               if (keyidx >= ARRAY_SIZE(dev->key)) {
> > +                       b43dbg(dev->wl, "RX: invalid key index %u\n", keyidx);
> > +                       goto drop;
> > +               }  
> 
> B43_WARN_ON() returns the condition's result, so if you keep it you
> can shorten this to
> 
> if (B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key)))
>         goto drop;

Acked-by: Michael Büsch <m@bues.ch>

Please also check the b43legacy driver. It may contain exactly the same code.

-- 
Michael Büsch
https://bues.ch/

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]