From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A44F7283FEA for ; Wed, 15 Apr 2026 08:38:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776242311; cv=none; b=snjdX2swlKMSrAIbsR4nSXCh7eneKNkpsV1OGJ3BkLZQv7dgRVciOLHFRKpmnbsNpgPxJpcB6MQwuobhXnbSiim7BlLr8z+UHA/eWbagnzZ4vz9hqn3E/5DdmtJuKWlp8vudHX1IqcInT8AiZUfhk50xTnIq/uMMJzSU1YOR9r0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776242311; c=relaxed/simple; bh=KseX38j6qGyfEm6dYHV42UbUam62ys6G2hqrUCCrpoM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=bLWsIZEDmSvvX6VOMXafNazTFX2j7ZHINhVgaGle3WKpBRoSf3i7Gebk9zAIKSRoKRqXekfIJ2F89eK5zBQ91SEiubRzgv7J248JoWZ7CFUpkJ8oIJWfB+Z8N43rZTI3PkfQYS1X+MEQ0Wv3XLU3SFxHzy+dKOAWDREkjFYhBCQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=A/CpjCZ8; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="A/CpjCZ8" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-488b8bc6bc9so46535465e9.3 for ; Wed, 15 Apr 2026 01:38:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776242308; x=1776847108; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=fPSUp+sO6VcHLm7/luI38Bv83ZTw3gEBrD3agBPIf1I=; b=A/CpjCZ8FROALII9zz0V82f4745LqUvtIc6GL6eUTzp+NTkoAVWAVBwsHJ2h1zqlGh 55nCFviyNCHuHEu8oApYvy5/tE8qyvIC1dTNH5EIt2MUnBbcBDY7dPOMeKXYc/5MBDVk b3lrCLGR4av+eVfGpDkyAwL86UhjaVhLMOdgqalPTbfZNvYdLoVvlJFSCcWSVcGuMxP/ dgk4bv9Vpy+n2LEuH+KOAarAJJrSvOtIMl1bwjarCbmFlGKS8AZdVPzL4kkYcAZYvd9t AUPu3KV6MGZ+V9vIvHwFq4yajW1AqLoOVav5We5dSOlsQ4TGgkI9zJE8upFb+aR8QmDh UViQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776242308; x=1776847108; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fPSUp+sO6VcHLm7/luI38Bv83ZTw3gEBrD3agBPIf1I=; b=arFnLB91SJ1glJSGnpmlLBj/xhmf4iGjNtOZ7528A2nIGxvttw0yzs+OQ8voK1LSsx QIG/yrNrsYFas8+57dzZRIKQRm/fNyLaaiNWe/3DHAIAoqBsL6z0/4dmAJAVbgpoao5R qzj9GJ0Not+5L3Ab6yr9LIA24+SpzZKFBGsc/xArV+u1QmZVGQkgF2PHal5wOLuI3cuY AfA6RF98FtwbU0Dhy/n8hW1Te1pUTdbteoJmXsfkBCd2siBxU9MjTcygaVqzv8LRhukE LVqjXGON5UCDFNkgX/0vYRjnfEmSRnC6l96KPckjaUQnu1MKaG18gWz/vjvcGO6EzQtj 5LGg== X-Forwarded-Encrypted: i=1; AFNElJ8qZAfEgDrJo4/dVHKl4RcCpHy7R618Be8V6yNS+qqbUT9DMLEomH4XcJu0oDfhIsVTcMquk2i+7+KaNac=@vger.kernel.org X-Gm-Message-State: AOJu0Yzr0PPfInbmEITWsJtnpmDmO04EsQc50DbxaULmi/dnTx9NiDcs 0zIuh0/AwW3dgIN3DCcRe1AShFrxD9vbRrydEZ/xdYnLE0Ufi39zP/r3 X-Gm-Gg: AeBDieveztxr0I+4y1C/cCZ5OVnBF1phrMo09CXbncwFPsscvum/7FP9T4AhveRokIU ngJkfS4W6bmk7APUK1m1vrxijgs2P9TFaqXaUpQ3LmIbhmZiYEistVzikiCVzYuTUfv1qb8VsuP HjSb49q3ajb9TkPlcFTon+k2WdpSKp7Bom59g0PyArPlz2zc+DcZjWmUqMSbvvThcBLr6Lo9Kio JQsL94RPw7a020o1zZJ0r9r+KN/Dkj4h27vOMPhn7ODYRsDLvzysF8eK4yS6V+7Y0Z3781aSxC8 9jwdSUKRpqWkQ/nxNm4l55ah2cPDHiyO2TzRoYqpGw6ixIuQRx9dQ/Ov55t/GxOMBfRpgcj/X5c uKwjfpSeHhWNF5hpBvfH/O+9Psc7gLIbbVAaFwJyH6MBAm3WP+Toz2MUHMnnOkNCESdP3tJ0Qqs dXJFOF883gzsiXI+XYzvc= X-Received: by 2002:a05:600c:5249:b0:488:c40b:c8a4 with SMTP id 5b1f17b1804b1-488d68057cdmr265756195e9.1.1776242307812; Wed, 15 Apr 2026 01:38:27 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488ee042f3dsm99109025e9.12.2026.04.15.01.38.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 01:38:26 -0700 (PDT) Date: Wed, 15 Apr 2026 11:38:23 +0300 From: Dan Carpenter To: luka.gejak@linux.dev Cc: Greg Kroah-Hartman , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] staging: rtl8723bs: fix null pointer deref in rtw_check_bcn_info Message-ID: References: <20260414205520.157861-1-luka.gejak@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260414205520.157861-1-luka.gejak@linux.dev> On Tue, Apr 14, 2026 at 10:55:20PM +0200, luka.gejak@linux.dev wrote: > From: Luka Gejak > > When parsing beacon or probe response frames, if the ap does not provide > a valid ssid ie, rtw_get_ie() returns NULL. The code then blindly > performs a memcpy() using the returned NULL pointer (p + 2), resulting > in a kernel oops or kernel panic due to a NULL pointer dereference. > > Fix this by moving the memcpy() inside the if (p) block so it is only > executed when a valid ssid ie is actually found. > > Fixes: 370730894bec ("Staging: rtl8723bs: rtw_wlan_util: Add size check of SSID IE") > Cc: stable@vger.kernel.org > Signed-off-by: Luka Gejak > --- > drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c > index 6a7c09db4cd9..2a8aec37d9b0 100644 > --- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c > +++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c > @@ -1204,8 +1204,8 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len) > ssid_len = *(p + 1); > if (ssid_len > NDIS_802_11_LENGTH_SSID) > ssid_len = 0; > + memcpy(bssid->ssid.ssid, (p + 2), ssid_len); > } > - memcpy(bssid->ssid.ssid, (p + 2), ssid_len); This isn't a bug. Doing an memcpy() of zero bytes is a no-op. I think there might be an issue in user space where some of these functions functions are marked as not accepting NULL pointers. It leads to weirdness because the compiler starts making assumptions based on that and, for example, strips away all the subsequent NULL checks. But in the kernel it's fine. Still this change does make the code more readable. Please, could you send the patch again with a commit message that explains that it is not a bugfix, only a cleanup and remove the Fixes tag. regards, dan carpenter