From nobody Fri Oct 2 13:07:30 2026 Received: from red-soft.ru (red-soft.ru [188.246.186.2]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D574348C77 for ; Fri, 31 Jul 2026 07:01:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=188.246.186.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481293; cv=none; b=UqYWsMXwesV1OxBmEvOf1uMklACeuI+zN7NW4cRIxfXEz3p+F0BLZ+FPdhH7va0SSVf97BC8iyC9luWEu8ucoDPZ7lYJBqyUx4HqVVS/VoNi17MLkFDU3l4qP2Q2/Jj/CvBKZwRrpbagxDwmSHnYmQdqZeK25wxsexxB7Xu87Rc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481293; c=relaxed/simple; bh=94NxW6S6rgTFntzcX1zBAoMm0RpW+nrszNYRfBBOXlQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=c9BNcTOzpqDb6y9xgT8+e8ax4lNprue0c3d+N3qs82zV34V+XoFfeNdrt0DAH33+D29J6b7EmlagqAmyo9NB42yzOZLxJJD5xLX8DWgml5DuxWvqsKrDswSBUZWxPf++ZVRl6jy/pg+nwcch6fnO+73OoaAeLlkpB9MJE3Z+kQA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=red-soft.ru; spf=pass smtp.mailfrom=red-soft.ru; arc=none smtp.client-ip=188.246.186.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=red-soft.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=red-soft.ru Received: from localhost.localdomain (unknown [10.81.7.147]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by red-soft.ru (Postfix) with ESMTPSA id B6F99262E69; Fri, 31 Jul 2026 10:01:33 +0300 (MSK) From: Roman Demidov To: Greg Kroah-Hartman Cc: Roman Demidov , Khushal Chitturi , Hungyu Lin , Minu Jin , Archit Anant , Ayushman Rout , Kees Cook , linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, artem.chernyshev@red-soft.ru Subject: [PATCH] staging: rtl8723bs: Fix NULL pointer dereference in c2h_wk_callback Date: Fri, 31 Jul 2026 10:00:50 +0300 Message-ID: <20260731070052.6582-1-roman.demidov@red-soft.ru> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-KSMG-AntiPhishing: NotDetected X-KSMG-AntiSpam-Auth: dkim=none X-KSMG-AntiSpam-Envelope-From: roman.demidov@red-soft.ru X-KSMG-AntiSpam-Info: LuaCore: 113 0.3.113 b83a27b0bdff87150e3aba5d24ea90b4a220db99, {Tracking_ml_letters}, {Tracking_from_domain_doesnt_match_to}, FromAlignment: s X-KSMG-AntiSpam-Interceptor-Info: scan successful X-KSMG-AntiSpam-Lua-Profiles: 204910 [Jul 31 2026] X-KSMG-AntiSpam-Method: none X-KSMG-AntiSpam-Rate: 0 X-KSMG-AntiSpam-Status: not_detected X-KSMG-AntiSpam-Version: 6.1.1.22 X-KSMG-AntiVirus: Kaspersky Secure Mail Gateway, version 2.1.0.7854, bases: 2026/07/31 03:38:00 #28597279 X-KSMG-AntiVirus-Status: NotDetected, skipped X-KSMG-LinksScanning: NotDetected X-KSMG-Message-Action: skipped X-KSMG-Rule-ID: 1 Content-Type: text/plain; charset="utf-8" If the kmalloc function fails to allocate memory, the c2h_evt variable will be NULL. Its subsequent use in the rtw_hal_c2h_valid() function will result in a NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Roman Demidov --- drivers/staging/rtl8723bs/core/rtw_cmd.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/rtl8723bs/core/rtw_cmd.c b/drivers/staging/rtl= 8723bs/core/rtw_cmd.c index b932670f5d63..3c1149828718 100644 --- a/drivers/staging/rtl8723bs/core/rtw_cmd.c +++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c @@ -1716,6 +1716,8 @@ static void c2h_wk_callback(struct work_struct *work) kfree(c2h_evt); continue; } + } else { + continue; } } =20 --=20 2.53.0