mirror of
https://github.com/torvalds/linux.git
synced 2026-05-14 09:22:17 +02:00
1f4f78bf85
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Michael Büsch <m@bues.ch>
Fixes:
|
||
|---|---|---|
| .. | ||
| b43.h | ||
| bus.c | ||
| bus.h | ||
| debugfs.c | ||
| debugfs.h | ||
| dma.c | ||
| dma.h | ||
| Kconfig | ||
| leds.c | ||
| leds.h | ||
| lo.c | ||
| lo.h | ||
| main.c | ||
| main.h | ||
| Makefile | ||
| phy_a.h | ||
| phy_ac.c | ||
| phy_ac.h | ||
| phy_common.c | ||
| phy_common.h | ||
| phy_g.c | ||
| phy_g.h | ||
| phy_ht.c | ||
| phy_ht.h | ||
| phy_lcn.c | ||
| phy_lcn.h | ||
| phy_lp.c | ||
| phy_lp.h | ||
| phy_n.c | ||
| phy_n.h | ||
| pio.c | ||
| pio.h | ||
| ppr.c | ||
| ppr.h | ||
| radio_2055.c | ||
| radio_2055.h | ||
| radio_2056.c | ||
| radio_2056.h | ||
| radio_2057.c | ||
| radio_2057.h | ||
| radio_2059.c | ||
| radio_2059.h | ||
| rfkill.c | ||
| rfkill.h | ||
| sdio.c | ||
| sdio.h | ||
| sysfs.c | ||
| sysfs.h | ||
| tables_lpphy.c | ||
| tables_lpphy.h | ||
| tables_nphy.c | ||
| tables_nphy.h | ||
| tables_phy_ht.c | ||
| tables_phy_ht.h | ||
| tables_phy_lcn.c | ||
| tables_phy_lcn.h | ||
| tables.c | ||
| tables.h | ||
| wa.c | ||
| wa.h | ||
| xmit.c | ||
| xmit.h | ||