summaryrefslogtreecommitdiff
path: root/drivers/staging/rtl8723bs
AgeCommit message (Collapse)Author
9 daysstaging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()Muhammad Bilal
rtw_restruct_wmm_ie() scans in_ie for a WMM IE with: while (i < in_len) { ... if (i + 5 < in_len && in_ie[i] == 0xDD && ...) { ... break; } i += (in_ie[i + 1] + 2); /* to the next IE element */ } When the "i + 5 < in_len" match check fails simply because i is within 5 bytes of the end of the buffer (i.e. no WMM IE was found near the tail of in_ie), execution falls through to "i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len - 1 at that point, this is a 1-byte out-of-bounds read of an attacker-influenced IE buffer built from association/scan data. Commit a75281626fc8f ("staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 < in_len" guard to the match condition itself, but did not add an equivalent guard before the fallthrough advance, so the same class of OOB read remained reachable through the non-matching path. Add an explicit bounds check before advancing to the next IE. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260728125456.32359-4-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 daysstaging: rtl8723bs: fix OOB read in rtw_action_frame_parse()Muhammad Bilal
rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260728125456.32359-3-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
9 daysstaging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()Muhammad Bilal
rtw_get_wps_attr() walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte attribute header (2-byte ID + 2-byte length) fits inside the IE: if (attr_ptr + 4 > wps_ie + wps_ielen) break; u16 attr_id = get_unaligned_be16(attr_ptr); u16 attr_data_len = get_unaligned_be16(attr_ptr + 2); u16 attr_len = attr_data_len + 4; attr_data_len (and therefore attr_len) is read directly from the wire and is never checked against the remaining bytes in the IE before being used as the size of: memcpy(buf_attr, attr_ptr, attr_len); Since attr_len is fully attacker controlled (0 to 65535+4), this is both a heap OOB read of wps_ie, and, more seriously, a stack buffer overflow at several call sites where buf_attr is a single-byte stack variable, e.g. rtw_get_wps_attr_content()'s callers passing WPS_ATTR_SELECTED_REGISTRAR into a stack "u8 sr"/"u8 selected_registrar" (drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c, drivers/staging/rtl8723bs/core/rtw_mlme_ext.c). A crafted WPS IE in a beacon or probe response processed during scanning can therefore smash the stack of the parsing thread. rtw_get_wps_attr_content() itself has no independent length check and simply trusts the attr_len it gets back from rtw_get_wps_attr(), so fixing the bound here also fixes that caller. The "attr_ptr + 4 > wps_ie + wps_ielen" header check above was added by commit 1463ca3ec6601 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()"), which bounded the fixed header but never extended the check to cover the variable-length attribute data that follows it. Add that missing check before attr_len is used as a memcpy() length or accepted as a match. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260728125456.32359-2-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-25Merge tag 'staging-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of drivers/staging/ updates for 7.3-rc1. Nothing major in here at all, just lots of tiny coding style cleanups, refactoring, and minor "fixes" as found by some tools. Included in here - loads of coding style and refactoring in the rtl8723bs wireless driver - minor greybus driver cleanups - minor sm750fb driver cleanups - other even smaller driver cleanups All of these have been in linux-next for a weeks with no reported issues" * tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits) staging: rtl8723bs: add blank line after declaration staging: rtl8723bs: remove unused enumerations staging: rtl8723bs: use !psta instead of comparison to NULL staging: rtl8723bs: Replace custom RotR1 macro with ror16 staging: rtl8723bs: Remove multiple assignments staging: rtl8723bs: fix several line spaces in wifi.h staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe() staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase staging: rtl8723bs: wrap line over 100 characters staging: rtl8723bs: remove unnecessary whitespace staging: rtl8723bs: remove extra blank lines in rtw_qos.h staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper staging: rtl8723bs: remove debug fields from hal_com_data staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock' staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data staging: rtl8723bs: hal: remove unused readings from the chip staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data ...
2026-08-13Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/wangxun/ngbe/ngbe_main.c 5f3a13e0bb5e ("net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling") d661abdc30c2 ("net: ngbe: correct misleading interrupt comment") drivers/net/ipvlan/ipvlan_main.c e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") 00a40d809207 ("ipvlan: Support per-netns netdev unregistration.") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge tag 'wireless-next-2026-08-06' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-02wifi: cfg80211: convert cookie output to input parameterArend van Spriel
The remain_on_channel, mgmt_tx, and probe_peer ops previously used a u64 *cookie output parameter. Now that cfg80211 pre-assigns the cookie value before invoking drivers, the parameter conveys a value from caller to driver, not the other way around. Convert it to a plain u64 input parameter across the ops struct (cfg80211.h), rdev-ops.h wrappers, nl80211.c/mlme.c call sites, mac80211, and all driver implementations. The tx_control_port op is excluded: its cookie pointer is nullable (passed as NULL when dont_wait_for_ack is set), so the nullable pointer semantics are still required. Internal mac80211 helpers ieee80211_start_roc_work() and ieee80211_attach_ack_skb() still take u64 *cookie because they assign to the pointee; their callers now pass &cookie to take the address of the local value parameter. wil6210's internal wil_p2p_listen() is also updated to take u64 cookie since it is called directly from the remain_on_channel callback. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260731123509.1975281-12-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-02wifi: rtl8723bs: use pre-assigned cookie for mgmt_txArend van Spriel
Stop using params->buf address as cookie value and simply pass the pre-assigned cookie in frame tx status. This implementation seems to fire-and-forget the transmitted frame as the cookie is not used in any other way. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260731123509.1975281-11-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28staging: rtl8723bs: validate monitor transmit frame lengthsMariano Baragiola
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Signed-off-by: Mariano Baragiola <mbaragiola@linux.com> Link: https://patch.msgid.link/20260727160859.1917096-1-mbaragiola@linux.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: fix missing shared-key auth challenge length checkPanagiotis Petrakopoulos
The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Link: https://patch.msgid.link/20260720082409.168379-1-npetrakopoulos2003@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: fix OOB read in WMM_param_handler()Muhammad Bilal
WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE. The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer. The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260719041509.97894-1-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()Muhammad Bilal
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE. The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself. The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation. The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check. Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260719030631.88254-1-meatuni001@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: add blank line after declarationDang Vu Duc Hien
Fix the checkpatch.pl warning: "WARNING: Missing a blank line after declarations" in drv_types.h. Add a blank line between the variable declaration and the subsequent statement in RTW_ENABLE_FUNC() to comply with the kernel coding style. Signed-off-by: Dang Vu Duc Hien <dvdh12707@gmail.com> Link: https://patch.msgid.link/20260727195236.663392-1-dvdh12707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused enumerationsNikolay Kulikov
These enumerations and their values are never used anywhere else; remove them. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260727-rtl8723bs_rmove_enums-v1-1-7974aab6c86e@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: use !psta instead of comparison to NULLArnesh Banerjee
The psta pointer was compared against NULL using an explicit equality check. The kernel coding style prefers testing a pointer directly, so use !psta instead. This also silences a checkpatch CHECK: CHECK: Comparison to NULL could be written "!psta" No functional change. Signed-off-by: Arnesh Banerjee <linkrinku13@gmail.com> Link: https://patch.msgid.link/20260726232119.6392-1-linkrinku13@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: Replace custom RotR1 macro with ror16Patryk Gawroński
The custom RotR1 macro reuses its argument, which throws a checkpatch warning and can lead to unexpected side-effects if called with an expression that has side-effects. Remove the custom macro and replace its usages with the standard kernel ror16() function from <linux/bitops.h> to clean up the code. Signed-off-by: Patryk Gawroński <gawronski1.6@gmail.com> Link: https://patch.msgid.link/20260722215327.62791-1-gawronski1.6@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: Remove multiple assignmentsPatryk Gawroński
Fix a checkpatch warning by splitting multiple assignments on a single line into separate operations. This improves code readability and aligns with kernel coding style guidelines. Signed-off-by: Patryk Gawroński <gawronski1.6@gmail.com> Link: https://patch.msgid.link/20260722122618.41747-1-gawronski1.6@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: fix several line spaces in wifi.hSantiago Ruano Rincón
Address checkpatch.pl warnings fixing reports of type LINE_SPACING: WARNING: Missing a blank line after declarations CHECK: Please don't use multiple blank lines CHECK: Please use a blank line after function/struct/union/enum declarations Signed-off-by: Santiago Ruano Rincón <santiagorr@riseup.net> Reviewed-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260723153526.255965-1-santiagorr@riseup.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe()Leonardo Martins Martins
Remove redundant goto statement and return _SUCCESS directly. Signed-off-by: Leonardo Martins Martins <dev.lmmrtns@gmail.com> Link: https://patch.msgid.link/20260721183746.80069-1-dev.lmmrtns@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCaseOlivier Tanoh
Rename Restore_DM_Func_Flag to snake_case format to comply with the Linux kernel coding style. Signed-off-by: Olivier Tanoh <olivier.tanoh19@gmail.com> Link: https://patch.msgid.link/20260720124544.63457-4-olivier.tanoh19@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCaseOlivier Tanoh
Rename Save_DM_Func_Flag and Restore_DM_Func_Flag to snake_case format to comply with the Linux kernel coding style. Signed-off-by: Olivier Tanoh <olivier.tanoh19@gmail.com> Link: https://patch.msgid.link/20260720124544.63457-3-olivier.tanoh19@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: wrap line over 100 charactersDalvin-Ehinoma Noah Aiguobas
Fix checkpatch warning by wrapping the lines. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260719115451.4401-3-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unnecessary whitespaceDalvin-Ehinoma Noah Aiguobas
Remove unnecessary whitespace to improve readability and coding style consistency. No functional changes are intended in this patch. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260719115451.4401-2-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove extra blank lines in rtw_qos.hSom Tripathi
Fix checkpatch.pl warnings by removing extra blank lines: - after the license header, before the include guard - inside the include guard, before the struct definition - before the closing #endif No functional change. Signed-off-by: Som Tripathi <tripathisom142004@gmail.com> Assisted-by: Claude:claude-sonnet-5 Link: https://patch.msgid.link/20260719075339.115500-1-somtri@iastate.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapperArsenii Pashchenko
Collapse the static CamelCase helper function ReadChipVersion8723B() directly into the main rtl8723b_read_chip_version() function. This removes unnecessary code nesting and cleans up the CamelCase naming violation in a single atomic change. Signed-off-by: Arsenii Pashchenko <ulijg308@gmail.com> Link: https://patch.msgid.link/20260718041431.9174-1-ulijg308@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove debug fields from hal_com_dataNikolay Kulikov
These fields are never set. They are never read from, since GetHalDefVar() function never receives the neccessary constants. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-10-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove 'rf_chip' from struct hal_com_dataNikolay Kulikov
The 'rf_chip' field is set to only one value (RF_6052), which makes any conditions with this field predictable. Remove it and the associated static functions (_ReadRFType() and _InitRFType()), since they simply set a value in the field and will be empty without it. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-9-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock'Nikolay Kulikov
Remove the 'SdioTxFIFOFreePageLock' spinlock from the struct hal_com_data, since the only operation performed on it is initialization, while the locking and unlocking calls are commented out. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-8-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_dataNikolay Kulikov
The value 'false' is written to this field but is not used. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-7-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: hal: remove unused readings from the chipNikolay Kulikov
These values are read from the chip but never used. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-6-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_dataNikolay Kulikov
The value 'true' is written to this field, but it is never used. Remove it and the case branch, as the latter becomes meaningless. This also requires removing calls to rtw_hal_set_hwreg() with the 'HW_VAR_DO_IQK' argument to prevent execution of the default branch containing the netdev_dbg() call in SetHwReg(). Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-5-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_dataNikolay Kulikov
This field is always initialized to 'false' but is never used. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-4-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused array MCSTxPowerLevelOriginalOffsetNikolay Kulikov
Remove the 'MCSTxPowerLevelOriginalOffset' array and the 'pwrGroupCnt' field (which is used as an index for that array), as values are being written to it but are no longer used. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: remove unused 'CCK_24G_Diff' from hal_com_dataNikolay Kulikov
Values are written to this array, but they are never used. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260717185407.56513-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: use kfree_sensitive() for key materialIvy Lopez
The set_stakey_parm struct contains a 16-byte encryption key. Use kfree_sensitive() instead of kfree() to ensure the key material is zeroed before the memory is freed, preventing potential information leaks. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Ivy Lopez <skunkolee@gmail.com> Link: https://patch.msgid.link/20260717220135.17836-1-skunkolee@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: wrap line over 100 charactersDalvin-Ehinoma Noah Aiguobas
Fix checkpatch warning by wrapping the lines. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260717161329.3400-3-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: change struct member bDriverStoppedDalvin-Ehinoma Noah Aiguobas
Member name does not adhere to linux coding style. Changed type as well since b indicates a boolean type and in every instance of setting the variable the values true and false are used. bDriverStopped -> driver_stopped Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260717161329.3400-2-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: reformat rtw_efuse_read_1_byte() signatureMoksh Panicker
Reformat the multi-line function signature to a single line to fix the following checkpatch.pl warning: WARNING: function definition argument 'struct adapter *Adapter' should also have an identifier name Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com> Link: https://patch.msgid.link/20260717160328.8739-1-mokshpanicker.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename Update_RA_Entry to update_ra_entryAnirban Bose
I changed the Update_RA_Entry() function to update_ra_entry() to fix the camelcase warning by checkpatch, I updated every instance it was present and I have checked it successfully building the driver with the changes I have done. Signed-off-by: Anirban Bose <boses156@gmail.com> Link: https://patch.msgid.link/20260717140006.2443-1-boses156@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename camelcase variable psurveyParaMax Raulea
Reported style issue by checkpatch in the rtl8723bs driver. changed the variable name to survey_para to adhere to Linux Kernel coding style. Signed-off-by: Max Raulea <max.raulea@gmail.com> Link: https://patch.msgid.link/amhTbmQRr1MzBa6G@archlinux Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27Merge 7.2-rc5 into staging-nextGreg Kroah-Hartman
We need the staging driver fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()Moksh Panicker
rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable <stable@kernel.org> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com> Link: https://patch.msgid.link/20260625202911.26782-1-mokshpanicker.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix inverted HT40 secondary channel offsetMinJea Kim
rtw_get_chan_type() maps the driver's channel offset to nl80211 channel types the wrong way around. In this driver HAL_PRIME_CHNL_OFFSET_LOWER means the primary channel is the lower 20 MHz half of the 40 MHz pair, i.e. the secondary channel is above the primary one: rtw_get_center_ch() computes the center channel as "channel + 2" for OFFSET_LOWER, and bwmode_update_check() sets OFFSET_LOWER when the AP's HT operation IE announces SCA (secondary channel above). In nl80211 terms that is NL80211_CHAN_HT40PLUS, not HT40MINUS. Because of the inversion, cfg80211_rtw_get_channel() reports an HT40+ association as HT40-. For an HT40+ AP on a low channel (e.g. channel 3) the resulting chandef spans below the 2.4 GHz band edge and is invalid, so the regulatory core tears the connection down 60 seconds (REG_ENFORCE_GRACE_MS) after the AP's country IE triggers a regdomain change: reg_check_chans_work() considers the reported chandef unusable and calls cfg80211_leave(). The supplicant then reconnects, the country IE changes the regdomain again, and the cycle repeats, causing a disconnect/reconnect loop every ~65 seconds for as long as the link is up. Observed on a TECLAST X80 Power tablet (RTL8723BS) associated to an HT40+ AP on channel 3 with a KR country IE; a kprobe trace showed cfg80211_disconnect() being invoked from reg_check_chans_work(). With the mapping fixed, "iw dev wlan0 info" reports the correct "width: 40 MHz, center1: 2432 MHz" and the periodic disconnects stop. Fixes: 5402cc178c5d ("staging: rtl8723bs: add get_channel cfg80211 implementation") Cc: stable@vger.kernel.org Assisted-by: Claude-Code:claude-fable-5 bpftrace Signed-off-by: MinJea Kim <qndkdrnl@gmail.com> Link: https://patch.msgid.link/20260714131421.3980-1-qndkdrnl@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Split multiple assignments in _rtw_open_pktfileAmin Madani
In _rtw_open_pktfile(), multiple variables are assigned on the same line. According to the Linux kernel coding style, multiple assignments on a single line should be avoided. Split them into separate lines to improve readability. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260716083822.2898-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Fix spacing around ternary operator in sdio_intf.cAmin Madani
Add spaces around '?' and ':' in the return statement in sdio_intf.c according to the Linux kernel coding style. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Link: https://patch.msgid.link/20260715170606.96002-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error pathsCong Nguyen
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq(). Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Cong Nguyen <congnt264@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260715111710.295052-1-congnt264@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: rtw_mlme: make rtw_add_network() staticGongwei Li
Function rtw_add_network() used only in rtw_mlme.c file, so it should be declared static. Remove the redundant prototype and add static keyword to the definition. Signed-off-by: Gongwei Li <ligongwei@kylinos.cn> Link: https://patch.msgid.link/20260715085542.1648015-1-13875017792@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: convert rtw_xmitframe_coalesce() to return errnoHungyu Lin
Convert rtw_xmitframe_coalesce() to return 0 on success and a negative errno on failure. Propagate errno values returned by the helper functions instead of converting them to _FAIL. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-6-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: simplify rtw_xmitframe_coalesce() control flowHungyu Lin
Replace goto-based error handling with direct returns and remove the temporary res variable. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-5-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: convert xmitframe_addmic() to return errnoHungyu Lin
Convert xmitframe_addmic() to return 0 on success and a negative errno on failure. Update the immediate caller to handle errno return values while preserving the existing _SUCCESS/_FAIL semantics. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-4-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-10 02:17:10 +0000