Re: [PATCH 0/4] staging: rtl8723bs: fix several memory-safety bugs

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Jul 29, 2026 at 10:25:05AM +0800, Yi Cong wrote:
> From: Yi Cong <yicong@kylinos.cn>
> 
> This small series fixes four memory-safety / resource-management bugs in
> the rtl8723bs SDIO staging driver.
> 
> All four are tagged:
> 
>   Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> 
>   1/4 - kfree() used on a vzalloc() allocation (HalData) in the probe
>         error path.
>   2/4 - double free / UAF when register_netdev() fails: the error label
>         frees objects that the caller also frees.
>   3/4 - NULL deref in c2h_wk_callback() when the re-read allocation under
>         memory pressure fails.
>   4/4 - NULL deref on a bcmc station lookup in the 802.11 defrag path,
>         reachable from a fragment with an unknown transmitter address.
> 
> Yi Cong (4):
>   staging: rtl8723bs: free HalData with vfree, not kfree
>   staging: rtl8723bs: fix double free when register_netdev() fails
>   staging: rtl8723bs: fix NULL deref in c2h_wk_callback() on alloc
>     failure
>   staging: rtl8723bs: fix NULL deref on bcmc station lookup in defrag
>     path
> 
>  drivers/staging/rtl8723bs/core/rtw_cmd.c     |  6 ++++++
>  drivers/staging/rtl8723bs/core/rtw_recv.c    |  5 ++++-
>  drivers/staging/rtl8723bs/os_dep/os_intfs.c  | 10 ++++++----
>  drivers/staging/rtl8723bs/os_dep/sdio_intf.c |  2 +-
>  4 files changed, 17 insertions(+), 6 deletions(-)

Did you forget to document the tool you used to find and fix these
issues?

thanks,

greg k-h