Re: [PATCH v3] staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Tue, Apr 14, 2026 at 11:00:02AM +0300, Dan Carpenter wrote:
> On Tue, Apr 14, 2026 at 10:55:56AM +0300, Dan Carpenter wrote:
> > On Tue, Apr 14, 2026 at 10:46:13AM +0300, Andy Shevchenko wrote:
> > > On Tue, Apr 14, 2026 at 12:43:06PM +0530, Shyam Sunder Reddy Padira wrote:

...

> > > > --- a/drivers/staging/rtl8723bs/os_dep/osdep_service.c
> > > > +++ b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
> > > > @@ -194,7 +194,8 @@ struct rtw_cbuf *rtw_cbuf_alloc(u32 size)
> > > >  	struct rtw_cbuf *cbuf;
> > > >  
> > > >  	cbuf = kzalloc_flex(*cbuf, bufs, size);
> > > > -	cbuf->size = size;
> > > > +	if (cbuf)
> > > > +		cbuf->size = size;
> > > >  
> > > >  	return cbuf;
> > > 
> > > Now to the code. This is still buggy. The problem is that the size is not
> > > validated and when it's 0, the same issue (dereference of invalid pointer)
> > > will happen.
> > > 
> > > Dan, JFYI k*alloc*(0) returns not NULL and not valid pointer.
> > 
> > kzalloc_flex() basically can't return the ZERO_SIZE pointer.
> 
> I meant ZERO_SIZE_PTR.

Ah, true, I missed the _flex vs. _objs part. Then the patch is fine as is.

-- 
With Best Regards,
Andy Shevchenko