In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Fix error pointer dereference

The function brcmfchipaddcore() can return an error pointer and is not checked. Add checks for error pointer.

Detected by Smatch: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmfchiprecognition() error: 'core' dereferencing possible ERRPTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmfchiprecognition() error: 'core' dereferencing possible ERRPTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmfchiprecognition() error: 'core' dereferencing possible ERRPTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmfchiprecognition() error: 'core' dereferencing possible ERRPTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmfchiprecognition() error: 'core' dereferencing possible ERRPTR()

[add missing wifi: prefix]

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: validate bsscfg indices in IF events

brcmffwehhandleifevent() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.

Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.

[add missing wifi prefix]