From nobody Sun Feb 8 13:39:46 2026 Received: from cvsmtppost33.nm.naver.com (cvsmtppost33.nm.naver.com [114.111.35.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573EA2C21F3 for ; Wed, 21 Jan 2026 02:54:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=114.111.35.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768964048; cv=none; b=MTAEPASFGxS2o8/+ZRPnLV1FafSLkH7oCfz6IMGKFOM1+Di20hCB17ZdPs0tS0oVt1rgcCzdTquCWUo7U5jQFmOtWVNt3cwBQU1iTYT8zNq31pqQUiDcJN3iVku3HeFTK49D7NX7bTsEgXj5mn0HNYRgNiTF/fdA+rhvXECV3mQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768964048; c=relaxed/simple; bh=oOZZpOD5BcFaxOMEEY5HK0eE2V2qq/9v3fGW9AvAWsA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=io25JyBYxAyrFiWCKFoJ5C5Tn/UVubRLQp2qA7QcpS1Y6oDM/jXO4KxdlaCOfcO7iMS0xwPG+Tm/n9bENG9vpc7m+ZFGfO4LIcTnlMCuhtO44CJX/gxn8HQeeDvEXE5O7gN+DMrMmfD8bqH4UGrWOp1A/HgSpGqhabjrfhCtUoY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=naver.com; spf=pass smtp.mailfrom=naver.com; dkim=pass (2048-bit key) header.d=naver.com header.i=@naver.com header.b=gjDpkPPy; arc=none smtp.client-ip=114.111.35.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=naver.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=naver.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=naver.com header.i=@naver.com header.b="gjDpkPPy" Received: from cvsendbo015.nm ([10.112.22.33]) by cvsmtppost33.nm.naver.com with ESMTP id N5PDIog1TO6a0fa5Lkdezw for ; Wed, 21 Jan 2026 02:33:44 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=naver.com; s=s20171208; t=1768962824; bh=oOZZpOD5BcFaxOMEEY5HK0eE2V2qq/9v3fGW9AvAWsA=; h=From:To:Subject:Date:Message-ID:From:Subject:Feedback-ID: X-Works-Security; b=gjDpkPPyPGZKvakjFvCrnYphpN7s388AyhfKrSdoJtPN5FQmoV3Zg17Il3w1c6Tc+ Ye6lLU57N3zhQoSvC9svk8m4ceEqceGv9ge0ViIbIRi/rwFuWGBua4YNf2QpLNPdj9 klGkjdCbnjAfBVVvcwzEngUXNpBTup/+1RS418a6qWCfqhn4bPQB8A/bXT/TX8RKh+ szFD3Of14apl8zL7ELKCP66WyboaOd0BtWwxsN10K/tKwbEfw8WobAMd/09MzTOCDG er2zbuB/fTl73OTF1UrbJS8AQsI8TkFiMRcADdhy7UTh/fw4inY/k6+SHn1l5gvSWY cE5N+A8G6tzNg== X-Session-ID: 8yycSvyATTWzdnTvSNR7Ng X-Works-Send-Opt: p/Y/jAJYjHmwKo2qKqJYFquqFNwkx0eFjAJYKg== X-Works-Smtp-Source: Vwnqax2rFqJZ+HmdKotm+6E= Received: from JMW-Ubuntu.. ([14.38.141.199]) by cvnsmtp003.nm.naver.com with ESMTP id 8yycSvyATTWzdnTvSNR7Ng for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 21 Jan 2026 02:33:44 -0000 From: Minu Jin To: gregkh@linuxfoundation.org Cc: andriy.shevchenko@linux.intel.com, abrahamadekunle50@gmail.com, milospuric856@gmail.com, zxcv2569763104@gmail.com, dan.carpenter@linaro.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Minu Jin Subject: [PATCH v4] staging: rtl8723bs: fix unchecked return value of skb_copy_bits Date: Wed, 21 Jan 2026 11:33:12 +0900 Message-ID: <20260121023312.2264431-1-s9430939@naver.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The function _rtw_pktfile_read() incorrectly updated the file pointer even when skb_copy_bits() failed. This patch fixes the issue by: 1. Propagating the negative error code from skb_copy_bits() if it fails, preventing internal pointer updates. 2. Updating all callers (including set_qos) to check the return value and handle errors appropriately. Signed-off-by: Minu Jin --- Changes in v4: - Modify _rtw_pktfile_read() to return -EINVAL if the remaining data is less than the requested length (suggested by Greg KH). - Use standard 'unsigned int' instead of 'uint' (suggested by Andy Shevchenko) - Remove the local variable 'len' to simplify logic and avoid redundant assignment drivers/staging/rtl8723bs/core/rtw_xmit.c | 42 +++++++++++++++---- .../staging/rtl8723bs/include/xmit_osdep.h | 2 +- drivers/staging/rtl8723bs/os_dep/xmit_linux.c | 21 ++++++---- 3 files changed, 46 insertions(+), 19 deletions(-) diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rt= l8723bs/core/rtw_xmit.c index 21690857fd62..f24f89ab65ad 100644 --- a/drivers/staging/rtl8723bs/core/rtw_xmit.c +++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c @@ -596,23 +596,31 @@ u8 qos_acm(u8 acm_mask, u8 priority) return priority; } =20 -static void set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib) +static int set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib) { struct ethhdr etherhdr; struct iphdr ip_hdr; s32 UserPriority =3D 0; + int ret; =20 _rtw_open_pktfile(ppktfile->pkt, ppktfile); - _rtw_pktfile_read(ppktfile, (unsigned char *)ðerhdr, ETH_HLEN); + ret =3D _rtw_pktfile_read(ppktfile, (unsigned char *)ðerhdr, ETH_HLEN); + if (ret < 0) + return ret; =20 /* get UserPriority from IP hdr */ if (pattrib->ether_type =3D=3D 0x0800) { - _rtw_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr)); + ret =3D _rtw_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr)); + if (ret < 0) + return ret; + UserPriority =3D ip_hdr.tos >> 5; } pattrib->priority =3D UserPriority; pattrib->hdrlen =3D WLAN_HDR_A3_QOS_LEN; pattrib->subtype =3D WIFI_QOS_DATA_TYPE; + + return 0; } =20 static s32 update_attrib(struct adapter *padapter, struct sk_buff *pkt, st= ruct pkt_attrib *pattrib) @@ -626,9 +634,12 @@ static s32 update_attrib(struct adapter *padapter, str= uct sk_buff *pkt, struct p struct mlme_priv *pmlmepriv =3D &padapter->mlmepriv; struct qos_priv *pqospriv =3D &pmlmepriv->qospriv; signed int res =3D _SUCCESS; + int ret; =20 _rtw_open_pktfile(pkt, &pktfile); - _rtw_pktfile_read(&pktfile, (u8 *)ðerhdr, ETH_HLEN); + ret =3D _rtw_pktfile_read(&pktfile, (u8 *)ðerhdr, ETH_HLEN); + if (ret < 0) + return ret; =20 pattrib->ether_type =3D ntohs(etherhdr.h_proto); =20 @@ -655,7 +666,9 @@ static s32 update_attrib(struct adapter *padapter, stru= ct sk_buff *pkt, struct p =20 u8 tmp[24]; =20 - _rtw_pktfile_read(&pktfile, &tmp[0], 24); + ret =3D _rtw_pktfile_read(&pktfile, &tmp[0], 24); + if (ret < 0) + return ret; =20 pattrib->dhcp_pkt =3D 0; if (pktfile.pkt_len > 282) {/* MINIMUM_DHCP_PACKET_SIZE) { */ @@ -737,11 +750,16 @@ static s32 update_attrib(struct adapter *padapter, st= ruct sk_buff *pkt, struct p pattrib->priority =3D 0; =20 if (check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MA= STER_STATE)) { - if (pattrib->qos_en) - set_qos(&pktfile, pattrib); + if (pattrib->qos_en) { + ret =3D set_qos(&pktfile, pattrib); + if (ret < 0) + return ret; + } } else { if (pqospriv->qos_option) { - set_qos(&pktfile, pattrib); + ret =3D set_qos(&pktfile, pattrib); + if (ret < 0) + return ret; =20 if (pmlmepriv->acm_mask !=3D 0) pattrib->priority =3D qos_acm(pmlmepriv->acm_mask, pattrib->priority); @@ -1039,6 +1057,7 @@ s32 rtw_xmitframe_coalesce(struct adapter *padapter, = struct sk_buff *pkt, struct =20 s32 bmcst =3D is_multicast_ether_addr(pattrib->ra); s32 res =3D _SUCCESS; + int ret; =20 if (!pxmitframe->buf_addr) return _FAIL; @@ -1054,7 +1073,9 @@ s32 rtw_xmitframe_coalesce(struct adapter *padapter, = struct sk_buff *pkt, struct } =20 _rtw_open_pktfile(pkt, &pktfile); - _rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen); + ret =3D _rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen); + if (ret < 0) + return ret; =20 frg_inx =3D 0; frg_len =3D pxmitpriv->frag_len - 4;/* 2346-4 =3D 2342 */ @@ -1096,6 +1117,9 @@ s32 rtw_xmitframe_coalesce(struct adapter *padapter, = struct sk_buff *pkt, struct mem_sz =3D _rtw_pktfile_read(&pktfile, pframe, mpdu_len); } =20 + if (mem_sz < 0) + return mem_sz; + pframe +=3D mem_sz; =20 if ((pattrib->icv_len > 0) && (pattrib->bswenc)) { diff --git a/drivers/staging/rtl8723bs/include/xmit_osdep.h b/drivers/stagi= ng/rtl8723bs/include/xmit_osdep.h index 8704dced593a..880344bffe2f 100644 --- a/drivers/staging/rtl8723bs/include/xmit_osdep.h +++ b/drivers/staging/rtl8723bs/include/xmit_osdep.h @@ -35,7 +35,7 @@ void rtw_os_xmit_resource_free(struct adapter *padapter, = struct xmit_buf *pxmitb =20 extern uint rtw_remainder_len(struct pkt_file *pfile); extern void _rtw_open_pktfile(struct sk_buff *pkt, struct pkt_file *pfile); -extern uint _rtw_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen); +int _rtw_pktfile_read(struct pkt_file *pfile, u8 *rmem, unsigned int rlen); extern signed int rtw_endofpktfile(struct pkt_file *pfile); =20 extern void rtw_os_pkt_complete(struct adapter *padapter, struct sk_buff *= pkt); diff --git a/drivers/staging/rtl8723bs/os_dep/xmit_linux.c b/drivers/stagin= g/rtl8723bs/os_dep/xmit_linux.c index 944b9c724b32..72cf8cd5f7c6 100644 --- a/drivers/staging/rtl8723bs/os_dep/xmit_linux.c +++ b/drivers/staging/rtl8723bs/os_dep/xmit_linux.c @@ -21,19 +21,22 @@ void _rtw_open_pktfile(struct sk_buff *pktptr, struct p= kt_file *pfile) pfile->cur_buffer =3D pfile->buf_start; } =20 -uint _rtw_pktfile_read(struct pkt_file *pfile, u8 *rmem, uint rlen) +int _rtw_pktfile_read(struct pkt_file *pfile, u8 *rmem, unsigned int rlen) { - uint len =3D 0; + int ret; =20 - len =3D rtw_remainder_len(pfile); - len =3D (rlen > len) ? len : rlen; + if (rtw_remainder_len(pfile) < rlen) + return -EINVAL; =20 - if (rmem) - skb_copy_bits(pfile->pkt, pfile->buf_len - pfile->pkt_len, rmem, len); + if (rmem) { + ret =3D skb_copy_bits(pfile->pkt, pfile->buf_len - pfile->pkt_len, rmem,= rlen); + if (ret < 0) + return ret; + } =20 - pfile->cur_addr +=3D len; - pfile->pkt_len -=3D len; - return len; + pfile->cur_addr +=3D rlen; + pfile->pkt_len -=3D rlen; + return rlen; } =20 signed int rtw_endofpktfile(struct pkt_file *pfile) --=20 2.43.0