commit b65a2d8c8614386f7e8d38ea150749f8a862f431 upstream.

The "ie_len" variable is in the 0-255 range and it comes from the
network.  If it's over NDIS_802_11_LENGTH_RATES_EX (16) then that will
lead to memory corruption.

Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200603101958.GA1845750@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

NULL check before kfree is unnecessary so remove it.

The following Coccinelle script was used to detect this:
@@ expression E; @@
- if (E != NULL) { kfree(E); }
+ kfree(E);
@@ expression E; @@
- if (E != NULL) { kfree(E); E = NULL; }
+ kfree(E);
+ E = NULL;

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200326132823.GA18625@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Correct typos in comments.
Misspellings found using checkpatch.pl.

Signed-off-by: R Veera Kumar <vkor@vkten.in>
Link: https://lore.kernel.org/r/20200326143023.13681-1-vkor@vkten.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Correct typos in comments.
Misspellings found using checkpatch.pl.

Signed-off-by: R Veera Kumar <vkor@vkten.in>
Link: https://lore.kernel.org/r/20200326125500.12861-1-vkor@vkten.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Correct typos in comments.
Misspellings found using checkpatch.pl.

Signed-off-by: R Veera Kumar <vkor@vkten.in>
Link: https://lore.kernel.org/r/20200326123540.12401-1-vkor@vkten.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Assignment to a typed pointer is sufficient in C.
No cast is needed.

The following Coccinelle script was used to detect this:
@r@
expression x;
void* e;
type T;
identifier f;
@@
(
  *((T *)e)
|
  ((T *)x)[...]
|
  ((T*)x)->f
|

- (T*)
  e
)

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200326113210.GA29951@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Simplify function returns by merging assignment and return into
one command line.
Found with Coccinelle

@@
local idexpression ret;
expression e;
@@

-ret =
+return
     e;
-return ret;

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200325214312.GA1936@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Compress two lines into a single line if immediate return statement is found.
It also removes variable cmd_obj as it is no longer needed.

It is done using script Coccinelle.
And coccinelle uses following semantic patch for this compression function:

@@
expression ret;
identifier f;
@@

-ret =
+return
     f(...);
-return ret;

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200325212253.GA8175@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Compress two lines into a single line if immediate return statement is found.

It is done using script Coccinelle. And coccinelle uses following semantic
patch for this compression function:

@@
expression ret;
identifier f;
@@

-ret =
+return
     f(...);
-return ret;

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200325205418.GA29149@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove unneeded blank line before a close brace '}'.
Issue found by checkpatch.pl:
CHECK: Blank lines aren't necessary before a close brace '}'

Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
Link: https://lore.kernel.org/r/20200325182617.GA9411@simran-Inspiron-5558
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>