I am experiencing a kernel crash triggered by Undefined Behavior Sanitizer
(UBSAN) detecting an array-index-out-of-bounds error in the
broadcom-sta-dkms module on kernel version 6.6.15-060615-generic.

The crash occurs in the function `_wl_set_multicast_list` inside
`wl_linux.c` and results in a kernel warning and stack trace. This issue
can cause system instability and affects network functionality.
---

Crash log excerpt:

[Tue Jun 24 15:58:42 2025]
================================================================================
[Tue Jun 24 15:58:42 2025] UBSAN: array-index-out-of-bounds in
/var/lib/dkms/broadcom-sta/6.30.223.271/build/src/wl/sys/wl_linux.c:1935:4
[Tue Jun 24 15:58:42 2025] index 2 is out of range for type 'ether_addr [1]'
[Tue Jun 24 15:58:42 2025] CPU: 4 PID: 5943 Comm: Chrome_IOThread Tainted:
P        W  OE      6.6.15-060615-generic #202402010035
[Tue Jun 24 15:58:42 2025] Hardware name: ASUS All Series/X99-DELUXE II,
BIOS 2101 07/10/2019
[Tue Jun 24 15:58:42 2025] Call Trace:
[Tue Jun 24 15:58:42 2025]  <TASK>
[Tue Jun 24 15:58:42 2025]  dump_stack_lvl+0x48/0x70
[Tue Jun 24 15:58:42 2025]  dump_stack+0x10/0x20
[Tue Jun 24 15:58:42 2025]  __ubsan_handle_out_of_bounds+0xc6/0x110
[Tue Jun 24 15:58:42 2025]  _wl_set_multicast_list+0x211/0x230 [wl]
[Tue Jun 24 15:58:42 2025]  wl_set_multicast_list+0x3a/0xa0 [wl]
[Tue Jun 24 15:58:42 2025]  __dev_set_rx_mode+0x79/0xe0
[Tue Jun 24 15:58:42 2025]  __dev_mc_add+0x94/0xa0
[Tue Jun 24 15:58:42 2025]  dev_mc_add+0x10/0x20
[Tue Jun 24 15:58:42 2025]  igmp_group_added+0x1b2/0x1e0
[Tue Jun 24 15:58:42 2025]  ____ip_mc_inc_group+0x1b9/0x320
[Tue Jun 24 15:58:42 2025]  __ip_mc_join_group+0x113/0x190
[Tue Jun 24 15:58:42 2025]  ip_mc_join_group+0x10/0x20
[Tue Jun 24 15:58:42 2025]  do_ip_setsockopt+0xfee/0x1070
[Tue Jun 24 15:58:42 2025]  ? inet_bind+0x12/0x20
[Tue Jun 24 15:58:42 2025]  ip_setsockopt+0x30/0xf0
[Tue Jun 24 15:58:42 2025]  udp_setsockopt+0x22/0x60
[Tue Jun 24 15:58:42 2025]  sock_common_setsockopt+0x1a/0x30
[Tue Jun 24 15:58:42 2025]  __sys_setsockopt+0xe1/0x1d0
[Tue Jun 24 15:58:42 2025]  __x64_sys_setsockopt+0x1f/0x40
[Tue Jun 24 15:58:42 2025]  do_syscall_64+0x5c/0x90
[Tue Jun 24 15:58:42 2025]  ? do_syscall_64+0x68/0x90
[Tue Jun 24 15:58:42 2025]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8

---

Steps to reproduce:
1. Load broadcom-sta-dkms version 6.30.223.271 on kernel
6.6.15-060615-generic.
2. Use network features that trigger multicast list updates (e.g., join
multicast groups).
3. Observe kernel crash with UBSAN report as above.

Expected behavior:
The driver should safely handle multicast lists without out-of-bounds
access or kernel crashes.

Actual behavior:
Kernel crashes due to UBSAN detecting an out-of-bounds array index in
`wl_linux.c`.

---

Patch included below to fix the array bounds error:

control: tags -1 + moreinfo

Hi Aleksey,

  The kernel version you're experiencing this issue with (6.6.15-
060615-generic) isn't a Debian kernel, but looks like it might be from
Ubuntu's "Mainline Test" packages
(https://kernel.ubuntu.com/mainline/v6.6.15/)? If so, you should report
this issue to Ubuntu, not Debian. If you are indeed running Debian,
it's generally considered unwise to install non-Debian packages on your
system (see https://wiki.debian.org/DontBreakDebian).

  Also, the full version of broadcom-sta-dkms is needed to assist with
resolving the issue. You reported the upstream version, but there's no
"-nn" (the Debian package revision) that allows us to know exactly what
version of the package you have installed on your system. Running
`dpkg -l broadcom-sta-dkms` should report the full version.

Mathias

severity: -1 normal

Considering the reported version is not in Debian, let me lower the severity.
There's no reason to get this package removed from trixie for a bug
that does not exist on trixie.
Thanks Mathias for pointing this out.
-Roger