kernel/linux.git/drivers/staging, branch v5.15.212

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

2026-07-24T13:51:58+00:00

[ Upstream commit 1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344 ] Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtw_get_sec_ie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain. rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at entry, before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside the attribute loop, get_unaligned_be16() is called on attr_ptr and attr_ptr+2 without checking that 4 bytes remain in the buffer. Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie() and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum IE length requirement, add a wps_ielen < 6 early return in rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260522004531.1038924-8-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: fix spaces around binary operators

2026-07-24T13:51:58+00:00

[ Upstream commit 0c9d1b56f9af0762a5be5118e1bb962f23784dc4 ] Add missing spaces and fix line length to comply with kernel coding style. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260221172751.52329-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 1463ca3ec660 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: core: move constants to right side in comparison

2026-07-24T13:51:57+00:00

[ Upstream commit cf0f2680c30d4b438a5e84b73dc70be405936b54 ] Move constants to right side in if-statement conditions. Signed-off-by: William Hansen-Baird Link: https://patch.msgid.link/20251224100329.762141-3-william.hansen.baird@gmail.com Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 1463ca3ec660 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: remove redundant braces in if statements

2026-07-24T13:51:57+00:00

[ Upstream commit 94579b02720bb63096312c4bc7694fd2f6df7cbb ] Adhere to Linux kernel coding style. Reported by checkpatch: WARNING: braces {} are not necessary for single statement blocks Signed-off-by: Sevinj Aghayeva Link: https://lore.kernel.org/r/20220331113245.GA425141@euclid Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 1463ca3ec660 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Remove redundant else branches.

2026-07-24T13:51:57+00:00

[ Upstream commit 4610e57a7d2edeef14aa852cd945f9920e1759da ] This patch fixes the following checkpatch.pl warning: WARNING: else is not generally useful after a break or return Signed-off-by: Sevinj Aghayeva Link: https://lore.kernel.org/r/20220329140904.GA3566@ubuntu Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 1463ca3ec660 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

2026-07-24T13:51:57+00:00

[ Upstream commit 5a752a616e756844388a1a45404db9fc29fec655 ] supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Reviewed-by: Luka Gejak Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260522004531.1038924-4-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Fix space issues

2026-07-24T13:51:57+00:00

[ Upstream commit c4b811b9361b0d7ea167a79587f5ec0a13fd8863 ] Fix the following checkpatch space issues: - CHECK: spaces preferred around that '*' (ctx:VxV) - CHECK: spaces preferred around that '+' (ctx:VxV) - CHECK: spaces preferred around that '-' (ctx:VxV) - CHECK: spaces preferred around that '|' (ctx:VxV) - CHECK: No space is necessary after a cast - WARNING: please, no spaces at the start of a line Signed-off-by: Franziska Naepelt Link: https://lore.kernel.org/r/20230701102538.5359-1-franziska.naepelt@googlemail.com Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Fix indentation issues

2026-07-24T13:51:57+00:00

[ Upstream commit b59cba2309b16fa364df03e3693b8d45c3fadbd6 ] Fix the following checkpatch indentation issues: - WARNING: suspect code indent for conditional statements (32, 48) - WARNING: suspect code indent for conditional statements (24, 24) - ERROR: code indent should use tabs where possible Signed-off-by: Franziska Naepelt Link: https://lore.kernel.org/r/20230619180351.18925-1-franziska.naepelt@gmail.com Signed-off-by: Greg Kroah-Hartman Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

staging: most: video: avoid double free on video register failure

2026-07-24T13:51:37+00:00

[ Upstream commit 7cb1c5b32a2bfde961fff8d5204526b609bcb30a ] comp_register_videodev() allocates a video_device with video_device_alloc() and releases it if video_register_device() fails. This can double free the video_device when __video_register_device() reaches device_register() and that call fails: video_register_device() -> __video_register_device() -> device_register() fails -> put_device(&vdev->dev) -> v4l2_device_release() -> vdev->release(vdev) -> video_device_release(vdev) comp_register_videodev() -> video_device_release(mdev->vdev) Use video_device_release_empty() while registering the device so that registration failure paths do not free mdev->vdev through vdev->release(). comp_register_videodev() then releases mdev->vdev exactly once on failure. Restore video_device_release() after successful registration so the registered device keeps its normal lifetime handling. This issue was found by a static analysis tool I am developing. Fixes: eab231c0398a ("staging: most: v4l2-aim: remove unnecessary label err_vbi_dev") Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260517111218.945796-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

staging: nvec: fix use-after-free in nvec_rx_completed()

2026-07-24T13:51:36+00:00

[ Upstream commit 26813881181deb3a32fbb59eadb2599cbe8423f6 ] In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin