[PATCH] staging: rtl8723bs: fix null pointer deref in rtw_check_bcn_info

[PATCH] staging: rtl8723bs: fix null pointer deref in rtw_check_bcn_info

[luka.gejak]

From: Luka Gejak <luka.gejak@linux.dev>

When parsing beacon or probe response frames, if the ap does not provide
a valid ssid ie, rtw_get_ie() returns NULL. The code then blindly
performs a memcpy() using the returned NULL pointer (p + 2), resulting
in a kernel oops or kernel panic due to a NULL pointer dereference.

Fix this by moving the memcpy() inside the if (p) block so it is only
executed when a valid ssid ie is actually found.

Fixes: 370730894bec ("Staging: rtl8723bs: rtw_wlan_util: Add size check of SSID IE")
Cc: stable@vger.kernel.org
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 6a7c09db4cd9..2a8aec37d9b0 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -1204,8 +1204,8 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
 		ssid_len = *(p + 1);
 		if (ssid_len > NDIS_802_11_LENGTH_SSID)
 			ssid_len = 0;
+		memcpy(bssid->ssid.ssid, (p + 2), ssid_len);
 	}
-	memcpy(bssid->ssid.ssid, (p + 2), ssid_len);
 	bssid->ssid.ssid_length = ssid_len;
 
 	if (memcmp(bssid->ssid.ssid, cur_network->network.ssid.ssid, 32) ||
-- 
2.53.0

Re: [PATCH] staging: rtl8723bs: fix null pointer deref in rtw_check_bcn_info

[Dan Carpenter]

On Tue, Apr 14, 2026 at 10:55:20PM +0200, luka.gejak@linux.dev wrote:
> From: Luka Gejak <luka.gejak@linux.dev>
> 
> When parsing beacon or probe response frames, if the ap does not provide
> a valid ssid ie, rtw_get_ie() returns NULL. The code then blindly
> performs a memcpy() using the returned NULL pointer (p + 2), resulting
> in a kernel oops or kernel panic due to a NULL pointer dereference.
> 
> Fix this by moving the memcpy() inside the if (p) block so it is only
> executed when a valid ssid ie is actually found.
> 
> Fixes: 370730894bec ("Staging: rtl8723bs: rtw_wlan_util: Add size check of SSID IE")
> Cc: stable@vger.kernel.org
> Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
> ---
>  drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> index 6a7c09db4cd9..2a8aec37d9b0 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
> @@ -1204,8 +1204,8 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
>  		ssid_len = *(p + 1);
>  		if (ssid_len > NDIS_802_11_LENGTH_SSID)
>  			ssid_len = 0;
> +		memcpy(bssid->ssid.ssid, (p + 2), ssid_len);
>  	}
> -	memcpy(bssid->ssid.ssid, (p + 2), ssid_len);

This isn't a bug.  Doing an memcpy() of zero bytes is a no-op.

I think there might be an issue in user space where some of these
functions functions are marked as not accepting NULL pointers.  It leads
to weirdness because the compiler starts making assumptions based on
that and, for example, strips away all the subsequent NULL checks.  But
in the kernel it's fine.

Still this change does make the code more readable.  Please, could you
send the patch again with a commit message that explains that it is
not a bugfix, only a cleanup and remove the Fixes tag.

regards,
dan carpenter