* [PATCH v7 7/7] staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
Three IE/attribute parsing functions have missing bounds checks.
rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer
without verifying that the header bytes (tag + length) are within the
remaining buffer before reading them. Additionally, rtw_get_sec_ie()
compares the 4-byte WPA OUI at cnt+2 without checking that at least
6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at
cnt+6 without checking that at least 10 bytes remain.
rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at
entry, before verifying that wps_ielen is large enough to contain
the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside
the attribute loop, get_unaligned_be16() is called on attr_ptr and
attr_ptr+2 without checking that 4 bytes remain in the buffer.
Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()
and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum
IE length requirement, add a wps_ielen < 6 early return in
rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index 72b7f731dd47..3c1f0068cd92 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -583,9 +583,14 @@ int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len)
cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);
while (cnt < in_len) {
+ if (cnt + 2 > in_len)
+ break;
+ if (cnt + 2 + in_ie[cnt + 1] > in_len)
+ break;
authmode = in_ie[cnt];
if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY &&
+ in_ie[cnt + 1] >= 8 &&
(!memcmp(&in_ie[cnt + 6], wapi_oui1, 4) ||
!memcmp(&in_ie[cnt + 6], wapi_oui2, 4))) {
if (wapi_ie)
@@ -616,9 +621,14 @@ void rtw_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie
cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);
while (cnt < in_len) {
+ if (cnt + 2 > in_len)
+ break;
+ if (cnt + 2 + in_ie[cnt + 1] > in_len)
+ break;
authmode = in_ie[cnt];
if ((authmode == WLAN_EID_VENDOR_SPECIFIC) &&
+ in_ie[cnt + 1] >= 4 &&
(!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
if (wpa_ie)
memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
@@ -699,6 +709,9 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id, u8 *buf_att
if (len_attr)
*len_attr = 0;
+ if (wps_ielen < 6)
+ return attr_ptr;
+
if ((wps_ie[0] != WLAN_EID_VENDOR_SPECIFIC) ||
(memcmp(wps_ie + 2, wps_oui, 4))) {
return attr_ptr;
@@ -709,6 +722,8 @@ u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id, u8 *buf_att
while (attr_ptr - wps_ie < wps_ielen) {
/* 4 = 2(Attribute ID) + 2(Length) */
+ if (attr_ptr + 4 > wps_ie + wps_ielen)
+ break;
u16 attr_id = get_unaligned_be16(attr_ptr);
u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);
u16 attr_len = attr_data_len + 4;
--
2.54.0
^ permalink raw reply related
* [PATCH v7 6/7] staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
The loop in is_ap_in_tkip() iterates over IEs without verifying that
enough bytes remain before dereferencing the IE header or its payload:
- pIE->element_id and pIE->length are read without checking that
i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the
buffer causes an OOB read.
- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12,
which requires pIE->length >= 16. For WLAN_EID_RSN it compares
pIE->data + 8, requiring pIE->length >= 12. Neither requirement
is checked.
Add the missing IE header and payload bounds checks and guard each
data access with an explicit pIE->length minimum, matching the
pattern established in update_beacon_info().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index dd34f229df12..94bbe7ac13ac 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1335,15 +1335,23 @@ unsigned int is_ap_in_tkip(struct adapter *padapter)
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
+ if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+ break;
+ if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+ break;
+
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
- if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) && (!memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4)))
+ if (pIE->length >= 16 &&
+ !memcmp(pIE->data, RTW_WPA_OUI, 4) &&
+ !memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4))
return true;
break;
case WLAN_EID_RSN:
- if (!memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
+ if (pIE->length >= 12 &&
+ !memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
return true;
break;
@@ -1351,7 +1359,7 @@ unsigned int is_ap_in_tkip(struct adapter *padapter)
break;
}
- i += (pIE->length + 2);
+ i += sizeof(*pIE) + pIE->length;
}
return false;
--
2.54.0
^ permalink raw reply related
* [PATCH v7 5/7] staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index c646dc2a1741..68ce422305ed 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -1406,7 +1406,11 @@ unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
/* to handle HT, WMM, rate adaptive, update MAC reg */
/* for not to handle the synchronous IO in the tasklet */
for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
+ if (i + sizeof(*pIE) > pkt_len)
+ break;
pIE = (struct ndis_80211_var_ie *)(pframe + i);
+ if (i + sizeof(*pIE) + pIE->length > pkt_len)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
--
2.54.0
^ permalink raw reply related
* [PATCH v7 4/7] staging: rtl8723bs: fix OOB write in HT_caps_handler()
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
HT_caps_handler() iterates pIE->length bytes and writes into
HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct
HT_caps_element). Because pIE->length is a raw u8 from an over-the-air
802.11 AssocResponse frame and is never validated, a malicious AP can
set it up to 255, causing up to 229 bytes of out-of-bounds writes into
adjacent fields of struct mlme_ext_info.
Truncate the iteration count to the size of HT_caps.u.HT_cap using
umin() so that data from a longer-than-expected IE is silently ignored
rather than written out of bounds, preserving interoperability with APs
that pad the element. An early return on oversized IEs was considered
but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1
assignment that precedes the loop, silently disabling HT mode for APs
that append extra bytes to the HT Capabilities IE.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index e0d73c267786..dd34f229df12 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -936,7 +936,8 @@ void HT_caps_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
pmlmeinfo->HT_caps_enable = 1;
- for (i = 0; i < (pIE->length); i++) {
+ for (i = 0; i < umin(pIE->length,
+ sizeof(pmlmeinfo->HT_caps.u.HT_cap)); i++) {
if (i != 2) {
/* Commented by Albert 2010/07/12 */
/* Got the endian issue here. */
--
2.54.0
^ permalink raw reply related
* [PATCH v7 3/7] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 098456e97c96..3d930d9af184 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -1443,6 +1443,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel
pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
if (pwpa && wpa_ielen > 0) {
+ if (wpa_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa_ie(pwpa, wpa_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1452,6 +1456,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel
pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
if (pwpa2 && wpa2_ielen > 0) {
+ if (wpa2_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
--
2.54.0
^ permalink raw reply related
* [PATCH v7 2/7] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the
association request. If the stored IE data ends with only an
element_id byte and no length byte, pIE->length is read one byte
past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has
the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index 884cd39ec756..c646dc2a1741 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -2931,7 +2931,11 @@ void issue_assocreq(struct adapter *padapter)
/* vendor specific IE, such as WPA, WMM, WPS */
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
+ if (i + sizeof(*pIE) > pmlmeinfo->network.ie_length)
+ break;
pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
+ if (i + sizeof(*pIE) + pIE->length > pmlmeinfo->network.ie_length)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
@@ -5324,7 +5328,11 @@ u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
/* sizeof(struct ndis_802_11_fix_ie) */
for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
+ if (i + sizeof(*pIE) > pnetwork->ie_length)
+ break;
pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);
+ if (i + sizeof(*pIE) + pIE->length > pnetwork->ie_length)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */
--
2.54.0
^ permalink raw reply related
* [PATCH v7 1/7] staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu, stable
In-Reply-To: <20260522004531.1038924-1-hossu.alexandru@gmail.com>
The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 6a7c09db4cd9..e0d73c267786 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1289,7 +1289,11 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
for (i = 0; i < len;) {
+ if (i + sizeof(*pIE) > len)
+ break;
pIE = (struct ndis_80211_var_ie *)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+ if (i + sizeof(*pIE) + pIE->length > len)
+ break;
switch (pIE->element_id) {
case WLAN_EID_VENDOR_SPECIFIC:
@@ -1314,7 +1318,7 @@ void update_beacon_info(struct adapter *padapter, u8 *pframe, uint pkt_len, stru
break;
}
- i += (pIE->length + 2);
+ i += sizeof(*pIE) + pIE->length;
}
}
--
2.54.0
^ permalink raw reply related
* [PATCH v7 0/7] staging: rtl8723bs: fix OOB reads and writes in IE/attribute parsing
From: Alexandru Hossu @ 2026-05-22 0:45 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, luka.gejak, Alexandru Hossu
In-Reply-To: <20260521130330.754181-1-hossu.alexandru@gmail.com>
Fix out-of-bounds memory accesses in several IE and attribute parsing
paths of the rtl8723bs driver. All affected functions iterate over
attacker-controlled IE data from over-the-air frames without validating
header or payload bounds before dereferencing.
Alexandru Hossu (7):
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
join_cmd_hdl()
staging: rtl8723bs: fix heap buffer overflow in
rtw_cfg80211_set_wpa_ie()
staging: rtl8723bs: fix OOB write in HT_caps_handler()
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),
rtw_get_wapi_ie(), and rtw_get_wps_attr()
.../staging/rtl8723bs/core/rtw_ieee80211.c | 15 ++++++++++++
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 12 ++++++++++
.../staging/rtl8723bs/core/rtw_wlan_util.c | 23 +++++++++++++++----
.../staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 +++++++
4 files changed, 53 insertions(+), 5 deletions(-)
---
v7: no code changes; add full version history to cover letter (omitted
from v6)
v6: add two patches addressing issues found during v5 review.
Patch 6 adds IE header bounds checks and payload length guards to
is_ap_in_tkip(). Patch 7 adds header and payload bounds checks to
rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr().
v5: patch 2: fix WPS truncation path reading past IE payload when
pIE->length < 14; strengthen WMM guard in join_cmd_hdl() from
pIE->length >= 4 to >= WLAN_WMM_LEN
v4: patch 1: add pkt_len underflow guard; fix WLAN_EID_VENDOR_SPECIFIC
condition ordering; fix bwmode_update_check() IE length check from
> to !=. Patch 2: add pIE->length >= 4 OUI guards; add HT_caps and
HT_info minimum length checks. Patch 3: add bounds checks in
rtw_get_wps_ie(); add WPS OUI length guard.
v3: add Fixes: 554c0a3abf21 and Cc: stable@vger.kernel.org to all
patches; move Reviewed-by above Signed-off-by
v2: patch 1: rewrite loop increment as sizeof(*pIE) + pIE->length for
consistency with the sizeof(*pIE) guards (Dan Carpenter)
v1: initial submission
v6: https://lore.kernel.org/r/20260521130330.754181-1-hossu.alexandru@gmail.com
v5: https://lore.kernel.org/r/20260511165743.1588637-1-hossu.alexandru@gmail.com
v4: https://lore.kernel.org/r/20260505173818.3674164-1-hossu.alexandru@gmail.com
v3: https://lore.kernel.org/r/20260427081626.3393697-1-hossu.alexandru@gmail.com
v2: https://lore.kernel.org/r/20260426095156.3523480-1-hossu.alexandru@gmail.com
v1: https://lore.kernel.org/r/20260424151932.3734611-1-hossu.alexandru@gmail.com
--
2.54.0
^ permalink raw reply
* [PATCH] staging: rtl8723bs: fix operator spacing
From: omkarbhor4011 @ 2026-05-22 0:30 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, Omkarbhor4011
From: omkarbhor4011 <Omkarbhor4011@gmail.com>
Signed-off-by: omkarbhor4011 <Omkarbhor4011@gmail.com>
---
.../staging/rtl8723bs/hal/rtl8723b_hal_init.c | 26 +++++++++----------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
index e794fe3ca..3bb1533e1 100644
--- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
+++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
@@ -21,23 +21,23 @@ static void _FWDownloadEnable(struct adapter *padapter, bool enable)
rtw_write8(padapter, REG_SYS_FUNC_EN + 1, tmp | 0x04);
tmp = rtw_read8(padapter, REG_MCUFWDL);
- rtw_write8(padapter, REG_MCUFWDL, tmp|0x01);
+ rtw_write8(padapter, REG_MCUFWDL, tmp | 0x01);
do {
tmp = rtw_read8(padapter, REG_MCUFWDL);
if (tmp & 0x01)
break;
- rtw_write8(padapter, REG_MCUFWDL, tmp|0x01);
+ rtw_write8(padapter, REG_MCUFWDL, tmp | 0x01);
msleep(1);
} while (count++ < 100);
/* 8051 reset */
- tmp = rtw_read8(padapter, REG_MCUFWDL+2);
- rtw_write8(padapter, REG_MCUFWDL+2, tmp&0xf7);
+ tmp = rtw_read8(padapter, REG_MCUFWDL + 2);
+ rtw_write8(padapter, REG_MCUFWDL + 2, tmp & 0xf7);
} else {
/* MCU firmware download disable. */
tmp = rtw_read8(padapter, REG_MCUFWDL);
- rtw_write8(padapter, REG_MCUFWDL, tmp&0xfe);
+ rtw_write8(padapter, REG_MCUFWDL, tmp & 0xfe);
}
}
@@ -70,8 +70,8 @@ static int _BlockWrite(struct adapter *padapter, void *buffer, u32 buffSize)
if (remainSize_p1) {
offset = blockCount_p1 * blockSize_p1;
- blockCount_p2 = remainSize_p1/blockSize_p2;
- remainSize_p2 = remainSize_p1%blockSize_p2;
+ blockCount_p2 = remainSize_p1 / blockSize_p2;
+ remainSize_p2 = remainSize_p1 % blockSize_p2;
}
/* 3 Phase #3 */
@@ -104,8 +104,8 @@ static int _PageWrite(
u8 value8;
u8 u8Page = (u8) (page & 0x07);
- value8 = (rtw_read8(padapter, REG_MCUFWDL+2) & 0xF8) | u8Page;
- rtw_write8(padapter, REG_MCUFWDL+2, value8);
+ value8 = (rtw_read8(padapter, REG_MCUFWDL + 2) & 0xF8) | u8Page;
+ rtw_write8(padapter, REG_MCUFWDL + 2, value8);
return _BlockWrite(padapter, buffer, size);
}
@@ -124,7 +124,7 @@ static int _WriteFW(struct adapter *padapter, void *buffer, u32 size)
for (page = 0; page < pageNums; page++) {
offset = page * MAX_DLFW_PAGE_SIZE;
- ret = _PageWrite(padapter, page, bufferPtr+offset, MAX_DLFW_PAGE_SIZE);
+ ret = _PageWrite(padapter, page, bufferPtr + offset, MAX_DLFW_PAGE_SIZE);
if (ret == _FAIL) {
netdev_dbg(padapter->pnetdev, "page write failed at %s %d\n",
@@ -136,7 +136,7 @@ static int _WriteFW(struct adapter *padapter, void *buffer, u32 size)
if (remainSize) {
offset = pageNums * MAX_DLFW_PAGE_SIZE;
page = pageNums;
- ret = _PageWrite(padapter, page, bufferPtr+offset, remainSize);
+ ret = _PageWrite(padapter, page, bufferPtr + offset, remainSize);
if (ret == _FAIL) {
netdev_dbg(padapter->pnetdev, "remaining page write failed at %s %d\n",
@@ -195,7 +195,7 @@ static s32 polling_fwdl_chksum(
if (value32 & FWDL_ChkSum_rpt || adapter->bSurpriseRemoved || adapter->bDriverStopped)
break;
yield();
- } while (jiffies_to_msecs(jiffies-start) < timeout_ms || cnt < min_cnt);
+ } while (jiffies_to_msecs(jiffies - start) < timeout_ms || cnt < min_cnt);
if (!(value32 & FWDL_ChkSum_rpt)) {
goto exit;
@@ -1888,7 +1888,7 @@ void rtl8723b_fill_fake_txdesc(
if (IsPsPoll) {
SET_TX_DESC_NAV_USE_HDR_8723B(pDesc, 1);
} else {
- SET_TX_DESC_HWSEQ_EN_8723B(pDesc, 1); /* Hw set sequence number */
+ SET_TX_DESC_HWSEQ_EN_8723B(pDesc, 1);
SET_TX_DESC_HWSEQ_SEL_8723B(pDesc, 0);
}
--
2.54.0
^ permalink raw reply related
* [PATCH] Staging: sm750fb: Change camelCase to snake_case
From: Michail Tatas @ 2026-05-21 23:39 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
Change variable names from camelCase to snake_case
as per the Linux Kernel standards.
These changes remove 9 CHECK messages from checkpatch.pl
regarding sm750.c, sm750.h and sm750_hw.c
Tested changes by building the module sm750fb/
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 32 +++++++++++++++---------------
drivers/staging/sm750fb/sm750.h | 14 ++++++-------
drivers/staging/sm750fb/sm750_hw.c | 20 +++++++++----------
3 files changed, 33 insertions(+), 33 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 9f3e3d37e82a..3124380beb81 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -622,26 +622,26 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
output->paths = sm750_pnc;
crtc->channel = sm750_primary;
crtc->o_screen = 0;
- crtc->v_screen = sm750_dev->pvMem;
+ crtc->v_screen = sm750_dev->pv_mem;
break;
case sm750_simul_sec:
output->paths = sm750_pnc;
crtc->channel = sm750_secondary;
crtc->o_screen = 0;
- crtc->v_screen = sm750_dev->pvMem;
+ crtc->v_screen = sm750_dev->pv_mem;
break;
case sm750_dual_normal:
if (par->index == 0) {
output->paths = sm750_panel;
crtc->channel = sm750_primary;
crtc->o_screen = 0;
- crtc->v_screen = sm750_dev->pvMem;
+ crtc->v_screen = sm750_dev->pv_mem;
} else {
output->paths = sm750_crt;
crtc->channel = sm750_secondary;
/* not consider of padding stuffs for o_screen,need fix */
crtc->o_screen = sm750_dev->vidmem_size >> 1;
- crtc->v_screen = sm750_dev->pvMem + crtc->o_screen;
+ crtc->v_screen = sm750_dev->pv_mem + crtc->o_screen;
}
break;
case sm750_dual_swap:
@@ -649,7 +649,7 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
output->paths = sm750_panel;
crtc->channel = sm750_secondary;
crtc->o_screen = 0;
- crtc->v_screen = sm750_dev->pvMem;
+ crtc->v_screen = sm750_dev->pv_mem;
} else {
output->paths = sm750_crt;
crtc->channel = sm750_primary;
@@ -657,7 +657,7 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
* need fix
*/
crtc->o_screen = sm750_dev->vidmem_size >> 1;
- crtc->v_screen = sm750_dev->pvMem + crtc->o_screen;
+ crtc->v_screen = sm750_dev->pv_mem + crtc->o_screen;
}
break;
default:
@@ -755,13 +755,13 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
* must be set after crtc member initialized
*/
crtc->cursor.offset = crtc->o_screen + crtc->vidmem_size - 1024;
- crtc->cursor.mmio = sm750_dev->pvReg +
+ crtc->cursor.mmio = sm750_dev->pv_reg +
0x800f0 + (int)crtc->channel * 0x140;
crtc->cursor.max_h = 64;
crtc->cursor.max_w = 64;
crtc->cursor.size = crtc->cursor.max_h * crtc->cursor.max_w * 2 / 8;
- crtc->cursor.vstart = sm750_dev->pvMem + crtc->cursor.offset;
+ crtc->cursor.vstart = sm750_dev->pv_mem + crtc->cursor.offset;
memset_io(crtc->cursor.vstart, 0, crtc->cursor.size);
if (!g_hwcursor)
@@ -859,9 +859,9 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
sm750_dev->init_parm.chip_clk = 0;
sm750_dev->init_parm.mem_clk = 0;
sm750_dev->init_parm.master_clk = 0;
- sm750_dev->init_parm.powerMode = 0;
- sm750_dev->init_parm.setAllEngOff = 0;
- sm750_dev->init_parm.resetMemory = 1;
+ sm750_dev->init_parm.power_mode = 0;
+ sm750_dev->init_parm.set_all_eng_off = 0;
+ sm750_dev->init_parm.reset_memory = 1;
/* defaultly turn g_hwcursor on for both view */
g_hwcursor = 3;
@@ -880,9 +880,9 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
} else if (!strncmp(opt, "nocrt", strlen("nocrt"))) {
sm750_dev->nocrt = 1;
} else if (!strncmp(opt, "36bit", strlen("36bit"))) {
- sm750_dev->pnltype = sm750_doubleTFT;
+ sm750_dev->pnltype = sm750_double_tft;
} else if (!strncmp(opt, "18bit", strlen("18bit"))) {
- sm750_dev->pnltype = sm750_dualTFT;
+ sm750_dev->pnltype = sm750_dual_tft;
} else if (!strncmp(opt, "24bit", strlen("24bit"))) {
sm750_dev->pnltype = sm750_24TFT;
} else if (!strncmp(opt, "nohwc0", strlen("nohwc0"))) {
@@ -1028,7 +1028,7 @@ static int lynxfb_pci_probe(struct pci_dev *pdev,
sm750_dev->mtrr.vram = arch_phys_wc_add(sm750_dev->vidmem_start,
sm750_dev->vidmem_size);
- memset_io(sm750_dev->pvMem, 0, sm750_dev->vidmem_size);
+ memset_io(sm750_dev->pv_mem, 0, sm750_dev->vidmem_size);
pci_set_drvdata(pdev, sm750_dev);
@@ -1059,8 +1059,8 @@ static void lynxfb_pci_remove(struct pci_dev *pdev)
sm750fb_framebuffer_release(sm750_dev);
arch_phys_wc_del(sm750_dev->mtrr.vram);
- iounmap(sm750_dev->pvReg);
- iounmap(sm750_dev->pvMem);
+ iounmap(sm750_dev->pv_reg);
+ iounmap(sm750_dev->pv_mem);
pci_release_region(pdev, 1);
kfree(g_settings);
}
diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index 67b9bfa23f41..19dbb91201e3 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -14,8 +14,8 @@
enum sm750_pnltype {
sm750_24TFT = 0, /* 24bit tft */
- sm750_dualTFT = 2, /* dual 18 bit tft */
- sm750_doubleTFT = 1, /* 36 bit double pixel tft */
+ sm750_dual_tft = 2, /* dual 18 bit tft */
+ sm750_double_tft = 1, /* 36 bit double pixel tft */
};
/* vga channel is not concerned */
@@ -39,13 +39,13 @@ enum sm750_path {
};
struct init_status {
- ushort powerMode;
+ ushort power_mode;
/* below three clocks are in unit of MHZ*/
ushort chip_clk;
ushort mem_clk;
ushort master_clk;
- ushort setAllEngOff;
- ushort resetMemory;
+ ushort set_all_eng_off;
+ ushort reset_memory;
};
struct lynx_accel {
@@ -97,8 +97,8 @@ struct sm750_dev {
unsigned long vidreg_start;
__u32 vidmem_size;
__u32 vidreg_size;
- void __iomem *pvReg;
- unsigned char __iomem *pvMem;
+ void __iomem *pv_reg;
+ unsigned char __iomem *pv_mem;
/* locks*/
spinlock_t slock;
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index a2798d428663..238f3e97fa05 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -42,18 +42,18 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
}
/* now map mmio and vidmem */
- sm750_dev->pvReg =
+ sm750_dev->pv_reg =
ioremap(sm750_dev->vidreg_start, sm750_dev->vidreg_size);
- if (!sm750_dev->pvReg) {
+ if (!sm750_dev->pv_reg) {
dev_err(&pdev->dev, "mmio failed\n");
ret = -EFAULT;
goto err_release_region;
}
- sm750_dev->accel.dpr_base = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
- sm750_dev->accel.dp_port_base = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
+ sm750_dev->accel.dpr_base = sm750_dev->pv_reg + DE_BASE_ADDR_TYPE1;
+ sm750_dev->accel.dp_port_base = sm750_dev->pv_reg + DE_PORT_ADDR_TYPE1;
- mmio750 = sm750_dev->pvReg;
+ mmio750 = sm750_dev->pv_reg;
sm750_set_chip_type(sm750_dev->devid, sm750_dev->revid);
sm750_dev->vidmem_start = pci_resource_start(pdev, 0);
@@ -66,9 +66,9 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
sm750_dev->vidmem_size = ddk750_get_vm_size();
/* reserve the vidmem space of smi adaptor */
- sm750_dev->pvMem =
+ sm750_dev->pv_mem =
ioremap_wc(sm750_dev->vidmem_start, sm750_dev->vidmem_size);
- if (!sm750_dev->pvMem) {
+ if (!sm750_dev->pv_mem) {
dev_err(&pdev->dev, "Map video memory failed\n");
ret = -EFAULT;
goto err_unmap_reg;
@@ -77,7 +77,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
return 0;
err_unmap_reg:
- iounmap(sm750_dev->pvReg);
+ iounmap(sm750_dev->pv_reg);
err_release_region:
pci_release_region(pdev, 1);
return ret;
@@ -130,10 +130,10 @@ int hw_sm750_inithw(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
switch (sm750_dev->pnltype) {
case sm750_24TFT:
break;
- case sm750_doubleTFT:
+ case sm750_double_tft:
val |= PANEL_DISPLAY_CTRL_DOUBLE_PIXEL;
break;
- case sm750_dualTFT:
+ case sm750_dual_tft:
val |= PANEL_DISPLAY_CTRL_DUAL_DISPLAY;
break;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: add const to g_fbmode array
From: Diego Fernando Mancera Gomez @ 2026-05-21 21:09 UTC (permalink / raw)
To: gregkh, linux-staging
Cc: m.steinmoetzger, guojy.bj, straube.linux, error27, linux-kernel
In-Reply-To: <20260521210523.133725-2-diegomancera.dev@gmail.com>
Hi Greg, please ignore this patch, as it was sent by mistake. I am
retracting it due to compilation errors I found earlier.
On Thu, May 21, 2026 at 3:06 PM Diego Fernando Mancera Gómez
<diegomancera.dev@gmail.com> wrote:
>
> Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
> ---
> drivers/staging/sm750fb/sm750.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> index 89c811e0806c..8f533f3b1b42 100644
> --- a/drivers/staging/sm750fb/sm750.c
> +++ b/drivers/staging/sm750fb/sm750.c
> @@ -21,7 +21,7 @@
> static int g_hwcursor = 1;
> static int g_noaccel __ro_after_init;
> static int g_nomtrr __ro_after_init;
> -static const char *g_fbmode[] = {NULL, NULL};
> +static const char * const g_fbmode[] = {NULL, NULL};
> static const char *g_def_fbmode = "1024x768-32@60";
> static char *g_settings;
> static int g_dualview __ro_after_init;
> --
> 2.43.0
>
^ permalink raw reply
* [PATCH] x86/build: Add custom extraversion identifier to Makefile
From: Diego Fernando Mancera Gómez @ 2026-05-21 21:05 UTC (permalink / raw)
To: gregkh, linux-staging
Cc: m.steinmoetzger, guojy.bj, straube.linux, error27, linux-kernel,
Diego Fernando Mancera Gómez
In-Reply-To: <20260521210523.133725-1-diegomancera.dev@gmail.com>
Modify the top-level Makefile EXTRAVERSION variable to append a unique
user identifier '-capihw-v1'. This provides distinct verification
for custom compiled mainline trees during development audits.
Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
---
Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Makefile b/Makefile
index b7b80e84e..d7f717d8a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
VERSION = 7
PATCHLEVEL = 1
SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc3-capihw-v1
NAME = Baby Opossum Posse
# *DOCUMENTATION*
--
2.43.0
^ permalink raw reply related
* [PATCH] staging: sm750fb: add const to g_fbmode array
From: Diego Fernando Mancera Gómez @ 2026-05-21 21:05 UTC (permalink / raw)
To: gregkh, linux-staging
Cc: m.steinmoetzger, guojy.bj, straube.linux, error27, linux-kernel,
Diego Fernando Mancera Gómez
In-Reply-To: <20260521210523.133725-1-diegomancera.dev@gmail.com>
Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 89c811e0806c..8f533f3b1b42 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -21,7 +21,7 @@
static int g_hwcursor = 1;
static int g_noaccel __ro_after_init;
static int g_nomtrr __ro_after_init;
-static const char *g_fbmode[] = {NULL, NULL};
+static const char * const g_fbmode[] = {NULL, NULL};
static const char *g_def_fbmode = "1024x768-32@60";
static char *g_settings;
static int g_dualview __ro_after_init;
--
2.43.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: clean up if-else logic in odm_HWConfig.c
From: Diego Fernando Mancera Gómez @ 2026-05-21 21:05 UTC (permalink / raw)
To: gregkh, linux-staging
Cc: m.steinmoetzger, guojy.bj, straube.linux, error27, linux-kernel,
Diego Fernando Mancera Gómez
---
drivers/staging/rtl8723bs/hal/odm_HWConfig.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/staging/rtl8723bs/hal/odm_HWConfig.c b/drivers/staging/rtl8723bs/hal/odm_HWConfig.c
index c88d669cb086..2e47734a0ae9 100644
--- a/drivers/staging/rtl8723bs/hal/odm_HWConfig.c
+++ b/drivers/staging/rtl8723bs/hal/odm_HWConfig.c
@@ -228,18 +228,11 @@ static void odm_rx_phy_status_parsing(struct dm_odm_t *dm_odm,
odm_parsing_cfo(dm_odm, pkt_info, phy_sta_rpt->path_cfotail);
}
- /*
- * UI BSS List signal strength(in percentage), make it good
- * looking, from 0~100.
- * It is assigned to the BSS List in GetValueFromBeaconOrProbeRsp().
- */
- if (is_cck_rate) {
+ if (is_cck_rate)
phy_info->signal_strength = (u8)(odm_signal_scale_mapping(dm_odm, pwdb_all));
- } else {
- if (rf_rx_num != 0) {
- phy_info->signal_strength = (u8)(odm_signal_scale_mapping(dm_odm, total_rssi /= rf_rx_num));
- }
- }
+ else if (rf_rx_num != 0)
+ phy_info->signal_strength = (u8)(odm_signal_scale_mapping(dm_odm, total_rssi /= rf_rx_num));
+
}
static void odm_Process_RSSIForDM(
@@ -437,4 +430,3 @@ enum hal_status ODM_ConfigBBWithHeaderFile(
return HAL_STATUS_SUCCESS;
}
-
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: add const to g_fbmode array
From: Diego Fernando Mancera Gomez @ 2026-05-21 20:47 UTC (permalink / raw)
To: Ahmet Sezgin Duran; +Cc: Greg KH, linux-staging
In-Reply-To: <8c739c37-d94f-4fc1-82a7-9575f85236d2@sezginduran.net>
On Thu, May 21, 2026 at 2:33 PM Ahmet Sezgin Duran
<ahmet@sezginduran.net> wrote:
>
> Can you make sure that you had enabled the related module?
Hi Ahmet,
You caught me. I sincerely apologize.
I forced the compilation by running `make
drivers/staging/sm750fb/sm750.o` and immediately saw the errors:
`error: assignment of read-only location ‘g_fbmode[index]’`
I realize now that adding the second `const` breaks the driver because
`g_fbmode` is dynamically assigned at runtime inside `sm750fb_setup`
and `lynxfb_set_fbinfo`. The `checkpatch.pl` warning was a false
positive in this specific context, and I failed to verify the build
properly before sending the patch.
Please drop this patch. Thank you very much for the lesson in C
semantics, build discipline, and mailing list etiquette. It won't
happen again.
Regards,
Diego Fernando Mancera Gómez
On Thu, May 21, 2026 at 2:33 PM Ahmet Sezgin Duran
<ahmet@sezginduran.net> wrote:
>
> Replying an off-list email:
>
> > To: Ahmet Sezgin Duran Subject: Re: [PATCH] staging: sm750fb: add
> > const to g_fbmode array
> >
> > Hi Ahmet,
> >
> > Yes, I have verified the changes. I compiled the module using make
> > M=drivers/staging/sm750fb/ and it compiled successfully without any
> > errors or warnings.
> >
> > Regards, Diego Fernando Mancera Gómez
> >
> > On Thu, May 21, 2026 at 1:52 PM Ahmet Sezgin Duran
> > <ahmet@sezginduran.net> wrote:
> >>
> >> On 5/21/26 5:26 PM, Diego Fernando Mancera Gómez wrote:
> >>> Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
> >>> ---
> >>> drivers/staging/sm750fb/sm750.c | 2 +-
> >>> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> >>> index 89c811e0806c..8f533f3b1b42 100644
> >>> --- a/drivers/staging/sm750fb/sm750.c
> >>> +++ b/drivers/staging/sm750fb/sm750.c
> >>> @@ -21,7 +21,7 @@
> >>> static int g_hwcursor = 1;
> >>> static int g_noaccel __ro_after_init;
> >>> static int g_nomtrr __ro_after_init;
> >>> -static const char *g_fbmode[] = {NULL, NULL};
> >>> +static const char * const g_fbmode[] = {NULL, NULL};
> >>> static const char *g_def_fbmode = "1024x768-32@60";
> >>> static char *g_settings;
> >>> static int g_dualview __ro_after_init;
> >>
> >> Did you compile these changes?
> >>
> >> Regards,
> >> Ahmet Sezgin Duran
>
> Please reply emails using `Reply All` and avoid top posting.
>
> > Yes, I have verified the changes. I compiled the module using make
> > M=drivers/staging/sm750fb/ and it compiled successfully without any
> > errors or warnings.
>
> Can you make sure that you had enabled the related module?
>
> Regards,
> Ahmet Sezgin Duran
^ permalink raw reply
* [PATCH] staging: sm750fb: gate dualview dataflow using g_dualview
From: Ahmet Sezgin Duran @ 2026-05-21 20:44 UTC (permalink / raw)
To: gregkh; +Cc: linux-fbdev, linux-staging, linux-kernel, Ahmet Sezgin Duran
In sm750fb_setup and sm750fb_set_drv functions, the dualview
related code is guarded by `sm750_dev->fb_count > 1` condition.
That value is updated only after each framebuffer is registered,
while both guards are used before any increment.
Current flow:
lynxfb_pci_probe()
sm750fb_setup() // fb_count is 0
for each fb:
sm750fb_framebuffer_alloc()
lynxfb_set_fbinfo()
sm750fb_set_drv() // fb_count is 0 or 1
register_framebuffer()
sm750_dev->fb_count++; // fb_count is incremented
Thus even if `dualview=1` parameter is passed down to the driver,
fb_count is never > 1 at either check, so dualview dataflows are
not selected and crtc->vidmem_size is never halved.
Use `g_dualview` global variable instead of fb_count > 1 to correctly
enable dualview capabilities.
Fixes: a3f92cc94c61 ("staging: sm750fb: replace dual member of sm750_dev with fb_count")
Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
---
Found by code inspection. Not tested on sm750 hardware. This restores
the gate that selects the dual-display dataflow but does not validate
the rest of that path, which has been unreachable since commit a3f92cc94c61.
drivers/staging/sm750fb/sm750.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 89c811e0806c..3a4b9c06f770 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -591,7 +591,7 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
crtc = &par->crtc;
crtc->vidmem_size = sm750_dev->vidmem_size;
- if (sm750_dev->fb_count > 1)
+ if (g_dualview)
crtc->vidmem_size >>= 1;
/* setup crtc and output member */
@@ -896,7 +896,7 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
NO_PARAM:
if (sm750_dev->revid != SM750LE_REVISION_ID) {
- if (sm750_dev->fb_count > 1) {
+ if (g_dualview) {
if (swap)
sm750_dev->dataflow = sm750_dual_swap;
else
--
2.53.0
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: add const to g_fbmode array
From: Ahmet Sezgin Duran @ 2026-05-21 20:33 UTC (permalink / raw)
To: Diego Fernando Mancera Gómez, Greg KH; +Cc: linux-staging
In-Reply-To: <20260521142655.24408-1-diegomancera.dev@gmail.com>
Replying an off-list email:
> To: Ahmet Sezgin Duran Subject: Re: [PATCH] staging: sm750fb: add
> const to g_fbmode array
>
> Hi Ahmet,
>
> Yes, I have verified the changes. I compiled the module using make
> M=drivers/staging/sm750fb/ and it compiled successfully without any
> errors or warnings.
>
> Regards, Diego Fernando Mancera Gómez
>
> On Thu, May 21, 2026 at 1:52 PM Ahmet Sezgin Duran
> <ahmet@sezginduran.net> wrote:
>>
>> On 5/21/26 5:26 PM, Diego Fernando Mancera Gómez wrote:
>>> Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
>>> ---
>>> drivers/staging/sm750fb/sm750.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
>>> index 89c811e0806c..8f533f3b1b42 100644
>>> --- a/drivers/staging/sm750fb/sm750.c
>>> +++ b/drivers/staging/sm750fb/sm750.c
>>> @@ -21,7 +21,7 @@
>>> static int g_hwcursor = 1;
>>> static int g_noaccel __ro_after_init;
>>> static int g_nomtrr __ro_after_init;
>>> -static const char *g_fbmode[] = {NULL, NULL};
>>> +static const char * const g_fbmode[] = {NULL, NULL};
>>> static const char *g_def_fbmode = "1024x768-32@60";
>>> static char *g_settings;
>>> static int g_dualview __ro_after_init;
>>
>> Did you compile these changes?
>>
>> Regards,
>> Ahmet Sezgin Duran
Please reply emails using `Reply All` and avoid top posting.
> Yes, I have verified the changes. I compiled the module using make
> M=drivers/staging/sm750fb/ and it compiled successfully without any
> errors or warnings.
Can you make sure that you had enabled the related module?
Regards,
Ahmet Sezgin Duran
^ permalink raw reply
* Re: [PATCH] staging: sm750fb: add const to g_fbmode array
From: Ahmet Sezgin Duran @ 2026-05-21 19:52 UTC (permalink / raw)
To: Diego Fernando Mancera Gómez, Greg KH; +Cc: linux-staging
In-Reply-To: <20260521142655.24408-1-diegomancera.dev@gmail.com>
On 5/21/26 5:26 PM, Diego Fernando Mancera Gómez wrote:
> Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
> ---
> drivers/staging/sm750fb/sm750.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> index 89c811e0806c..8f533f3b1b42 100644
> --- a/drivers/staging/sm750fb/sm750.c
> +++ b/drivers/staging/sm750fb/sm750.c
> @@ -21,7 +21,7 @@
> static int g_hwcursor = 1;
> static int g_noaccel __ro_after_init;
> static int g_nomtrr __ro_after_init;
> -static const char *g_fbmode[] = {NULL, NULL};
> +static const char * const g_fbmode[] = {NULL, NULL};
> static const char *g_def_fbmode = "1024x768-32@60";
> static char *g_settings;
> static int g_dualview __ro_after_init;
Did you compile these changes?
Regards,
Ahmet Sezgin Duran
^ permalink raw reply
* Re: [PATCH] staging: greybus: audio: expect 0 from kstrtoint(), not 1
From: Alexander A. Klimov @ 2026-05-21 18:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Vaibhav Agarwal, Mark Greer, Johan Hovold, Alex Elder,
Elise Lennion, moderated list:GREYBUS SUBSYSTEM,
open list:STAGING SUBSYSTEM, open list
In-Reply-To: <2026052158-willing-dreadful-857b@gregkh>
On 5/21/26 10:38, Greg Kroah-Hartman wrote:
> On Wed, May 20, 2026 at 08:03:59PM +0200, Alexander A. Klimov wrote:
>> kstrtoint() returns "0 on success, -ERANGE on overflow
>> and -EINVAL on parsing error". In contrast,
>> manager_sysfs_remove_store() and manager_sysfs_dump_store()
>> checked for 1 which always failed the operation. I fixed this.
>>
>> Fixes: f9a21a3f4919 ("staging: greybus: audio_manager_sysfs: Replace sscanf with kstrto* to single variable conversion.")
>> Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
>> ---
>> drivers/staging/greybus/audio_manager_sysfs.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/staging/greybus/audio_manager_sysfs.c b/drivers/staging/greybus/audio_manager_sysfs.c
>> index fcd518f9540c..581791d566e3 100644
>> --- a/drivers/staging/greybus/audio_manager_sysfs.c
>> +++ b/drivers/staging/greybus/audio_manager_sysfs.c
>> @@ -44,7 +44,7 @@ static ssize_t manager_sysfs_remove_store(struct kobject *kobj,
>>
>> int num = kstrtoint(buf, 10, &id);
>>
>> - if (num != 1)
>> + if (num != 0)
>
> Doesn't checkpatch now complain about this?
No.
$ curl -fsSL https://lkml.org/lkml/diff/2026/5/20/2139/1 | scripts/checkpatch.pl
ERROR: Missing Signed-off-by: line(s)
total: 1 errors, 0 warnings, 0 checks, 16 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
Your patch has style problems, please review.
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
$
(Ok, sure, it says "Missing Signed-off-by:",
but https://lkml.org/lkml/diff/2026/5/20/2139/1
shows only the diff itself, not the headers.)
^ permalink raw reply
* [PATCH] staging: cleanup of sdio_intf.c
From: Manuel Ebner @ 2026-05-21 18:39 UTC (permalink / raw)
To: Greg Kroah-Hartman, Dan Carpenter, Omer El Idrissi,
open list:STAGING SUBSYSTEM, open list
Cc: Manuel Ebner
removed unused argument of rtw_sdio_if1_init()
removed empty lines, added linew where appropriate
Signed-off-by: Manuel Ebner <manuelebner@mailbox.org>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index d0feb28b7043..32a0ee08f175 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -47,7 +47,6 @@ static void sd_sync_int_hdl(struct sdio_func *func)
{
struct dvobj_priv *psdpriv;
-
psdpriv = sdio_get_drvdata(func);
if (!psdpriv->if1)
@@ -144,13 +143,13 @@ static void sdio_deinit(struct dvobj_priv *dvobj)
sdio_claim_host(func);
sdio_disable_func(func);
- if (dvobj->irq_alloc) {
+ if (dvobj->irq_alloc)
sdio_release_irq(func);
- }
sdio_release_host(func);
}
}
+
static struct dvobj_priv *sdio_dvobj_init(struct sdio_func *func)
{
struct dvobj_priv *dvobj = NULL;
@@ -216,8 +215,7 @@ static void sd_intf_stop(struct adapter *padapter)
rtw_hal_disable_interrupt(padapter);
}
-
-static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct sdio_device_id *pdid)
+static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj)
{
int status = _FAIL;
struct net_device *pnetdev;
@@ -250,7 +248,6 @@ static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct
/* 4 3.1 set hardware operation functions */
rtw_set_hal_ops(padapter);
-
/* 3 5. initialize Chip version */
padapter->intf_start = &sd_intf_start;
padapter->intf_stop = &sd_intf_stop;
@@ -336,9 +333,8 @@ static void rtw_sdio_if1_deinit(struct adapter *if1)
* notes: drv_init() is called when the bus driver has located a card for us to support.
* We accept the new device by returning 0.
*/
-static int rtw_drv_init(
- struct sdio_func *func,
- const struct sdio_device_id *id)
+static int rtw_drv_init(struct sdio_func *func,
+ const struct sdio_device_id *id)
{
int status = _FAIL;
struct adapter *if1 = NULL;
@@ -348,7 +344,7 @@ static int rtw_drv_init(
if (!dvobj)
goto exit;
- if1 = rtw_sdio_if1_init(dvobj, id);
+ if1 = rtw_sdio_if1_init(dvobj);
if (!if1)
goto free_dvobj;
--
2.54.0
^ permalink raw reply related
* [PATCH v4] staging: greybus: audio: correct sscanf() return value check
From: Alexander A. Klimov @ 2026-05-21 18:23 UTC (permalink / raw)
To: Vaibhav Agarwal, Mark Greer, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Pankaj Bharadiya, Viresh Kumar,
moderated list:GREYBUS SUBSYSTEM, open list:STAGING SUBSYSTEM,
open list
Cc: Alexander A. Klimov
manager_sysfs_add_store() passes 6 pointers to sscanf(),
but required latter to return 7 which always failed the operation.
I corrected it to 6.
Fixes: 49b9137a6002 ("staging: greybus: audio: remove redundant slot field")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
v2: added "Fixes:" to commit message
v3: added all these v2/v3 lines here as requested by Greg KH
v3: while on it, replaced title
v4: switched my mail client, so that the diff should apply now (fucking Thunderbird fucking trims fucking whitespace from my fucking patches so I had to fucking switch to fucking git-send-email(1))
drivers/staging/greybus/audio_manager_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/audio_manager_sysfs.c b/drivers/staging/greybus/audio_manager_sysfs.c
index 581791d566e3..3358d0c34f57 100644
--- a/drivers/staging/greybus/audio_manager_sysfs.c
+++ b/drivers/staging/greybus/audio_manager_sysfs.c
@@ -23,7 +23,7 @@ static ssize_t manager_sysfs_add_store(struct kobject *kobj,
desc.name, &desc.vid, &desc.pid, &desc.intf_id,
&desc.ip_devices, &desc.op_devices);
- if (num != 7)
+ if (num != 6)
return -EINVAL;
num = gb_audio_manager_add(&desc);
--
2.54.0
^ permalink raw reply related
* [PATCH] staging: rtl8723bs: remove unused rtl8192c function declarations
From: Pang-Chun Liu @ 2026-05-21 14:41 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, Pang-Chun Liu
rtl8192c_translate_rx_signal_stuff() and rtl8192c_query_rx_desc_status()
are declared in rtl8192c_recv.h but neither has a definition anywhere
in the driver, and there are no callers. Remove the dead declarations.
Signed-off-by: Pang-Chun Liu <kevin95120@gmail.com>
---
drivers/staging/rtl8723bs/include/rtl8192c_recv.h | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/staging/rtl8723bs/include/rtl8192c_recv.h b/drivers/staging/rtl8723bs/include/rtl8192c_recv.h
index 1f86654f0403..b63625ab4e45 100644
--- a/drivers/staging/rtl8723bs/include/rtl8192c_recv.h
+++ b/drivers/staging/rtl8723bs/include/rtl8192c_recv.h
@@ -30,7 +30,4 @@ struct phy_stat {
/* Rx smooth factor */
#define Rx_Smooth_Factor (20)
-void rtl8192c_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_status);
-void rtl8192c_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc);
-
#endif
--
2.53.0
^ permalink raw reply related
* [PATCH] staging: sm750fb: add const to g_fbmode array
From: Diego Fernando Mancera Gómez @ 2026-05-21 14:26 UTC (permalink / raw)
To: Greg KH; +Cc: linux-staging, Diego Fernando Mancera Gómez
Signed-off-by: Diego Fernando Mancera Gómez <diegomancera.dev@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 89c811e0806c..8f533f3b1b42 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -21,7 +21,7 @@
static int g_hwcursor = 1;
static int g_noaccel __ro_after_init;
static int g_nomtrr __ro_after_init;
-static const char *g_fbmode[] = {NULL, NULL};
+static const char * const g_fbmode[] = {NULL, NULL};
static const char *g_def_fbmode = "1024x768-32@60";
static char *g_settings;
static int g_dualview __ro_after_init;
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v6 0/7] staging: rtl8723bs: fix OOB reads and writes in IE/attribute parsing
From: Alexandru Hossu @ 2026-05-21 14:18 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, stable, Alexandru Hossu
In-Reply-To: <2026052158-mumps-margarita-afcd@gregkh>
Hi Greg,
Sorry about that :( was very tired when I sent these. Will add the full
version history for all previous versions and resend.
Thanks,
Alexandru
^ permalink raw reply
* Re: [PATCH v6 0/7] staging: rtl8723bs: fix OOB reads and writes in IE/attribute parsing
From: Greg KH @ 2026-05-21 14:11 UTC (permalink / raw)
To: Alexandru Hossu; +Cc: linux-staging, stable
In-Reply-To: <20260521130330.754181-1-hossu.alexandru@gmail.com>
On Thu, May 21, 2026 at 03:03:23PM +0200, Alexandru Hossu wrote:
> Fix out-of-bounds memory accesses in several IE and attribute parsing
> paths of the rtl8723bs driver. All affected functions iterate over
> attacker-controlled IE data from over-the-air frames without validating
> header or payload bounds before dereferencing.
>
> v6: add two patches addressing issues found during v5 review.
> Patch 6 adds IE header bounds checks and payload length guards to
> is_ap_in_tkip(). Patch 7 adds header and payload bounds checks to
> rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr().
>
You have to show all the version info for all versions :(
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox