Tristan Madani a035766f97 wifi: b43legacy: enforce bounds check on firmware key index in RX path ... Same fix as b43: the firmware-controlled key index in b43legacy_rx() can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of dev->key[]. Make the check enforcing by dropping the frame for invalid indices. Fixes: 75388acd0c ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Link: https://patch.msgid.link/20260417111145.2694196-2-tristmd@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2026-04-27 12:39:57 +02:00
..
b43legacy.h	wifi: b43: fix incorrect __packed annotation	2023-05-17 09:24:09 +03:00
debugfs.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
debugfs.h
dma.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
dma.h
ilt.c
ilt.h
Kconfig
leds.c	wifi: move from strlcpy with unused retval to strscpy	2022-09-02 11:47:22 +03:00
leds.h
main.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
main.h
Makefile
phy.c
phy.h
pio.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
pio.h
radio.c	wifi: b43legacy: remove unused freq_r3A_value function	2023-03-31 17:50:09 +03:00
radio.h
rfkill.c
rfkill.h
sysfs.c	wifi: b43: Convert sprintf/snprintf to sysfs_emit	2024-03-21 17:07:53 +02:00
sysfs.h
xmit.c	wifi: b43legacy: enforce bounds check on firmware key index in RX path	2026-04-27 12:39:57 +02:00
xmit.h