linux-stable.git/drivers/net/wireless/broadcom/b43, branch linux-rolling-lts

wifi: b43: enforce bounds check on firmware key index in b43_rx()

2026-05-14T13:30:12+00:00

commit 1f4f78bf8549e6ac4f04fba4176854f3a6e0c332 upstream.

The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.

Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.

Suggested-by: Jonas Gorski 
Acked-by: Michael Büsch 
Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani 
Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com
Signed-off-by: Johannes Berg 
Signed-off-by: Greg Kroah-Hartman

wifi: cfg80211/mac80211: Add support to get radio index

2025-06-24T13:19:27+00:00

Currently, per-radio attributes are set on per-phy basis, i.e., all the
radios present in a wiphy will take attributes values sent from user. But
each radio in a wiphy can get different values from userspace based on
its requirement.

To extend support to set per-radio attributes, add support to get radio
index from userspace. Add an NL attribute - NL80211_ATTR_WIPHY_RADIO_INDEX,
to get user specified radio index for which attributes should be changed.
Pass this to individual drivers, so that the drivers can use this radio
index to change per-radio attributes when necessary. Currently, per-radio
attributes identified are:
NL80211_ATTR_WIPHY_TX_POWER_LEVEL
NL80211_ATTR_WIPHY_ANTENNA_TX
NL80211_ATTR_WIPHY_ANTENNA_RX
NL80211_ATTR_WIPHY_RETRY_SHORT
NL80211_ATTR_WIPHY_RETRY_LONG
NL80211_ATTR_WIPHY_FRAG_THRESHOLD
NL80211_ATTR_WIPHY_RTS_THRESHOLD
NL80211_ATTR_WIPHY_COVERAGE_CLASS
NL80211_ATTR_TXQ_LIMIT
NL80211_ATTR_TXQ_MEMORY_LIMIT
NL80211_ATTR_TXQ_QUANTUM

By default, the radio index is set to -1. This means the attribute should
be treated as a global configuration. If the user has not specified any
index, then the radio index passed to individual drivers would be -1. This
would indicate that the attribute applies to all radios in that wiphy.

Signed-off-by: Roopni Devanathan 
Link: https://patch.msgid.link/20250615082312.619639-2-quic_rdevanat@quicinc.com
Signed-off-by: Johannes Berg

Merge tag 'wireless-next-2025-03-04-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2025-03-04T16:50:42+00:00

Johannes Berg says:

====================
First 6.15 material:
 * cfg80211/mac80211
   - remove cooked monitor support
   - strict mode for better AP testing
   - basic EPCS support
   - OMI RX bandwidth reduction support
 * rtw88
   - preparation for RTL8814AU support
 * rtw89
   - use wiphy_lock/wiphy_work
   - preparations for MLO
   - BT-Coex improvements
   - regulatory support in firmware files
 * iwlwifi
   - preparations for the new iwlmld sub-driver

* tag 'wireless-next-2025-03-04-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (128 commits)
  wifi: iwlwifi: remove mld/roc.c
  wifi: mac80211: refactor populating mesh related fields in sinfo
  wifi: cfg80211: reorg sinfo structure elements for mesh
  wifi: iwlwifi: Fix spelling mistake "Increate" -> "Increase"
  wifi: iwlwifi: add Debug Host Command APIs
  wifi: iwlwifi: add IWL_MAX_NUM_IGTKS macro
  wifi: iwlwifi: add OMI bandwidth reduction APIs
  wifi: iwlwifi: remove mvm prefix from iwl_mvm_d3_end_notif
  wifi: iwlwifi: remember if the UATS table was read successfully
  wifi: iwlwifi: export iwl_get_lari_config_bitmap
  wifi: iwlwifi: add support for external 32 KHz clock
  wifi: iwlwifi: mld: add a debug level for EHT prints
  wifi: iwlwifi: mld: add a debug level for PTP prints
  wifi: iwlwifi: remove mvm prefix from iwl_mvm_esr_mode_notif
  wifi: iwlwifi: use 0xff instead of 0xffffffff for invalid
  wifi: iwlwifi: location api cleanup
  wifi: cfg80211: expose update timestamp to drivers
  wifi: mac80211: add ieee80211_iter_chan_contexts_mtx
  wifi: mac80211: fix integer overflow in hwmp_route_info_get()
  wifi: mac80211: Fix possible integer promotion issue
  ...
====================

Link: https://patch.msgid.link/20250304125605.127914-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski

wifi: b43: Replace outdated firmware URL

2025-02-11T10:59:12+00:00

https://wireless.wiki.kernel.org site now redirects to
https://wireless.docs.kernel.org/en/latest/ making the reference
information for the b43 firmware inaccessible. Update the URL to the
current location.

Link: https://bugs.debian.org/1095062
Signed-off-by: Salvatore Bonaccorso 
Acked-by: Michael Büsch 
Link: https://patch.msgid.link/20250205110614.216958-1-carnil@debian.org
Signed-off-by: Johannes Berg

b43: stop embedding struct file_operations into their objects

2025-01-15T12:14:36+00:00

Use debugfs_get_aux() instead.  And switch to debugfs_short_fops, while we
are at it...

Signed-off-by: Al Viro 
Link: https://lore.kernel.org/r/20250112080705.141166-8-viro@zeniv.linux.org.uk
Signed-off-by: Greg Kroah-Hartman

move asm/unaligned.h to linux/unaligned.h

2024-10-02T21:23:23+00:00

asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.

auto-generated by the following:

for i in `git grep -l -w asm/unaligned.h`; do
	sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
	sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h

wifi: b43: Constify struct lpphy_tx_gain_table_entry

2024-08-07T17:15:56+00:00

'struct lpphy_tx_gain_table_entry' are not modified in this driver.

Constifying this structure moves some data to a read-only section, so
increase overall security.

On a x86_64, with allmodconfig:
Before:
======
   text	   data	    bss	    dec	    hex	filename
  16481	   6232	      0	  22713	   58b9	drivers/net/wireless/broadcom/b43/tables_lpphy.o

After:
=====
   text	   data	    bss	    dec	    hex	filename
  22305	    395	      0	  22700	   58ac	drivers/net/wireless/broadcom/b43/tables_lpphy.o

Signed-off-by: Christophe JAILLET 
Acked-By: Michael Büsch 
Signed-off-by: Kalle Valo 
Link: https://patch.msgid.link/e33bc9e6dff4a5b6cd8d0ab5399aa1abac5bef9d.1722753127.git.christophe.jaillet@wanadoo.fr

wifi: mac80211: inform the low level if drv_stop() is a suspend

2024-06-26T08:25:46+00:00

This will allow the low level driver to take different actions for
different flows.

Signed-off-by: Emmanuel Grumbach 
Signed-off-by: Miri Korenblit 
Link: https://patch.msgid.link/20240618192529.739036208b6e.Ie18a2fe8e02bf2717549d39420b350cfdaf3d317@changeid
Signed-off-by: Johannes Berg

wifi: b43: Convert sprintf/snprintf to sysfs_emit

2024-03-21T15:07:53+00:00

Per filesystems/sysfs.rst, show() should only use sysfs_emit()
or sysfs_emit_at() when formatting the value to be returned to user space.

coccinelle complains that there are still a couple of functions that use
snprintf(). Convert them to sysfs_emit().

sprintf() will be converted as weel if they have.

Generally, this patch is generated by
make coccicheck M= MODE=patch \
COCCI=scripts/coccinelle/api/device_attr_show.cocci

No functional change intended

CC: Larry Finger 
CC: Kalle Valo 
CC: linux-wireless@vger.kernel.org
CC: b43-dev@lists.infradead.org
Acked-by: Larry Finger 
Signed-off-by: Li Zhijian 
Signed-off-by: Kalle Valo 
Link: https://msgid.link/20240315055211.1347548-2-lizhijian@fujitsu.com

wifi: b43: silence sparse warnings

2024-02-28T11:37:22+00:00

sparse complains on this code about casts that lose bits
due to the usage of bitwise not, but really we do want
16 bits only, so clarify that by using masks.

Signed-off-by: Johannes Berg 
Signed-off-by: Kalle Valo 
Link: https://msgid.link/20240223114023.c64e2d348453.Iccc4ace1116721a044e5f31f40ea7709e72145f3@changeid