Subject: linux-next: manual merge of the staging tree with the staging.current tree

From: Mark Brown <[email-masked]>
Date: Wed, 25 Feb 2026 15:04:18 +0000

Hi all,

Today's linux-next merge of the staging tree got a conflict in:

  drivers/staging/rtl8723bs/core/rtw_ieee80211.c

between commit:

  f0109b9d3e1e4 ("staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()")

from the staging.current tree and commit:

  0c9d1b56f9af0 ("staging: rtl8723bs: fix spaces around binary operators")

from the staging tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index 3e2b5e6b07f93,605c32fd2e881..0000000000000
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@@ -109,7 -109,7 +109,7 @@@ int rtw_check_network_type(unsigned cha
  u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source,
  				unsigned int *frlen)
  {
- 	memcpy((void *)pbuf, (void *)source, len);
+ 	memcpy(pbuf, source, len);
  	*frlen = *frlen + len;
  	return pbuf + len;
  }
@@@ -126,7 -126,7 +126,7 @@@ u8 *rtw_set_ie(u8 *pbuf
  	*(pbuf + 1) = (u8)len;
  
  	if (len > 0)
- 		memcpy((void *)(pbuf + 2), (void *)source, len);
+ 		memcpy(pbuf + 2, source, len);
  
  	*frlen = *frlen + (len + 2);
  
@@@ -186,25 -186,20 +186,25 @@@ u8 *rtw_get_ie_ex(u8 *in_ie, uint in_le
  
  	cnt = 0;
  
 -	while (cnt < in_len) {
 -		if (eid == in_ie[cnt] &&
 -		    (!oui || !memcmp(&in_ie[cnt + 2], oui, oui_len))) {
 +	while (cnt + 2 <= in_len) {
 +		u8 ie_len = in_ie[cnt + 1];
 +
 +		if (cnt + 2 + ie_len > in_len)
 +			break;
 +
 +		if (eid == in_ie[cnt]
 +			&& (!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) {
  			target_ie = &in_ie[cnt];
  
  			if (ie)
 -				memcpy(ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
 +				memcpy(ie, &in_ie[cnt], ie_len + 2);
  
  			if (ielen)
 -				*ielen = in_ie[cnt + 1] + 2;
 +				*ielen = ie_len + 2;
  
  			break;
  		}
 -		cnt += in_ie[cnt + 1] + 2; /* goto next */
 +		cnt += ie_len + 2; /* goto next */
  	}
  
  	return target_ie;
@@@ -291,7 -286,7 +291,7 @@@ uint rtw_get_rateset_len(u8 *rateset
  int rtw_generate_ie(struct registry_priv *pregistrypriv)
  {
  	u8 wireless_mode;
- 	int	sz = 0, rateLen;
+ 	int	sz = 0, rate_len;
  	struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network;
  	u8 *ie = pdev_network->ies;
  
@@@ -326,13 -321,13 +326,13 @@@
  
  	rtw_set_supported_rate(pdev_network->supported_rates, wireless_mode);
  
- 	rateLen = rtw_get_rateset_len(pdev_network->supported_rates);
+ 	rate_len = rtw_get_rateset_len(pdev_network->supported_rates);
  
- 	if (rateLen > 8) {
+ 	if (rate_len > 8) {
  		ie = rtw_set_ie(ie, WLAN_EID_SUPP_RATES, 8, pdev_network->supported_rates, &sz);
- 		/* ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rateLen - 8), (pdev_network->supported_rates + 8), &sz); */
+ 		/* ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (pdev_network->supported_rates + 8), &sz); */
  	} else {
- 		ie = rtw_set_ie(ie, WLAN_EID_SUPP_RATES, rateLen, pdev_network->supported_rates, &sz);
+ 		ie = rtw_set_ie(ie, WLAN_EID_SUPP_RATES, rate_len, pdev_network->supported_rates, &sz);
  	}
  
  	/* DS parameter set */
@@@ -342,8 -337,8 +342,8 @@@
  
  	ie = rtw_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2, (u8 *)&(pdev_network->configuration.atim_window), &sz);
  
- 	if (rateLen > 8)
- 		ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rateLen - 8), (pdev_network->supported_rates + 8), &sz);
+ 	if (rate_len > 8)
+ 		ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (pdev_network->supported_rates + 8), &sz);
  
  	/* HT Cap. */
  	if ((pregistrypriv->wireless_mode & WIRELESS_11_24N) &&
@@@ -455,10 -450,10 +455,10 @@@ int rtw_parse_wpa_ie(u8 *wpa_ie, int wp
  		return _FAIL;
  	}
  
- 	if ((*wpa_ie != WLAN_EID_VENDOR_SPECIFIC) || (*(wpa_ie+1) != (u8)(wpa_ie_len - 2)) ||
- 	   (memcmp(wpa_ie+2, RTW_WPA_OUI_TYPE, WPA_SELECTOR_LEN))) {
+ 	if ((*wpa_ie != WLAN_EID_VENDOR_SPECIFIC) ||
+ 	    (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
+ 	    (memcmp(wpa_ie + 2, RTW_WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
  		return _FAIL;
- 	}
  
  	pos = wpa_ie;
  
@@@ -518,7 -513,7 +518,7 @@@ int rtw_parse_wpa2_ie(u8 *rsn_ie, int r
  		return _FAIL;
  	}
  
- 	if ((*rsn_ie != WLAN_EID_RSN) || (*(rsn_ie+1) != (u8)(rsn_ie_len - 2)))
+ 	if ((*rsn_ie != WLAN_EID_RSN) || (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
  		return _FAIL;
  
  	pos = rsn_ie;
@@@ -585,18 -580,18 +585,18 @@@ int rtw_get_wapi_ie(u8 *in_ie, uint in_
  	while (cnt < in_len) {
  		authmode = in_ie[cnt];
  
- 		/* if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY) */
- 		if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY && (!memcmp(&in_ie[cnt+6], wapi_oui1, 4) ||
- 					!memcmp(&in_ie[cnt+6], wapi_oui2, 4))) {
+ 		if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY &&
+ 		    (!memcmp(&in_ie[cnt + 6], wapi_oui1, 4) ||
+ 		     !memcmp(&in_ie[cnt + 6], wapi_oui2, 4))) {
  			if (wapi_ie)
- 				memcpy(wapi_ie, &in_ie[cnt], in_ie[cnt+1]+2);
+ 				memcpy(wapi_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
  
  			if (wapi_len)
- 				*wapi_len = in_ie[cnt+1]+2;
+ 				*wapi_len = in_ie[cnt + 1] + 2;
  
- 			cnt += in_ie[cnt+1]+2;  /* get next */
+ 			cnt += in_ie[cnt + 1] + 2;  /* get next */
  		} else {
- 			cnt += in_ie[cnt+1]+2;   /* get next */
+ 			cnt += in_ie[cnt + 1] + 2;   /* get next */
  		}
  	}
  
@@@ -619,9 -614,10 +619,10 @@@ void rtw_get_sec_ie(u8 *in_ie, uint in_
  	while (cnt < in_len) {
  		authmode = in_ie[cnt];
  
- 		if ((authmode == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt+2], &wpa_oui[0], 4))) {
+ 		if ((authmode == WLAN_EID_VENDOR_SPECIFIC) &&
+ 		    (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
  			if (wpa_ie)
- 				memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt+1]+2);
+ 				memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
  
  			*wpa_len = in_ie[cnt + 1] + 2;
  			cnt += in_ie[cnt + 1] + 2;  /* get next */
@@@ -630,10 -626,10 +631,10 @@@
  				if (rsn_ie)
  					memcpy(rsn_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
  
- 				*rsn_len = in_ie[cnt+1]+2;
- 				cnt += in_ie[cnt+1]+2;  /* get next */
+ 				*rsn_len = in_ie[cnt + 1] + 2;
+ 				cnt += in_ie[cnt + 1] + 2;  /* get next */
  			} else {
- 				cnt += in_ie[cnt+1]+2;   /* get next */
+ 				cnt += in_ie[cnt + 1] + 2;   /* get next */
  			}
  		}
  	}
@@@ -665,20 -661,20 +666,20 @@@ u8 *rtw_get_wps_ie(u8 *in_ie, uint in_l
  	while (cnt < in_len) {
  		eid = in_ie[cnt];
  
- 		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt+2], wps_oui, 4))) {
+ 		if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
  			wpsie_ptr = &in_ie[cnt];
  
  			if (wps_ie)
- 				memcpy(wps_ie, &in_ie[cnt], in_ie[cnt+1]+2);
+ 				memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
  
  			if (wps_ielen)
- 				*wps_ielen = in_ie[cnt+1]+2;
+ 				*wps_ielen = in_ie[cnt + 1] + 2;
  
- 			cnt += in_ie[cnt+1]+2;
+ 			cnt += in_ie[cnt + 1] + 2;
  
  			break;
  		}
- 		cnt += in_ie[cnt+1]+2; /* goto next */
+ 		cnt += in_ie[cnt + 1] + 2; /* goto next */
  	}
  
  	return wpsie_ptr;
@@@ -756,12 -752,12 +757,12 @@@ u8 *rtw_get_wps_attr_content(u8 *wps_ie
  
  	if (attr_ptr && attr_len) {
  		if (buf_content)
- 			memcpy(buf_content, attr_ptr+4, attr_len-4);
+ 			memcpy(buf_content, attr_ptr + 4, attr_len - 4);
  
  		if (len_content)
- 			*len_content = attr_len-4;
+ 			*len_content = attr_len - 4;
  
- 		return attr_ptr+4;
+ 		return attr_ptr + 4;
  	}
  
  	return NULL;
@@@ -851,9 -847,9 +852,9 @@@ static int rtw_ieee802_11_parse_vendor_
   * @show_errors: Whether to show parsing errors in debug log
   * Returns: Parsing result
   */
- enum ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
- 				struct rtw_ieee802_11_elems *elems,
- 				int show_errors)
+ enum parse_result rtw_ieee802_11_parse_elems(u8 *start, uint len,
+ 					     struct rtw_ieee802_11_elems *elems,
+ 					     int show_errors)
  {
  	uint left = len;
  	u8 *pos = start;
@@@ -869,7 -865,7 +870,7 @@@
  		left -= 2;
  
  		if (elen > left)
- 			return ParseFailed;
+ 			return PARSE_FAILED;
  
  		switch (id) {
  		case WLAN_EID_SSID:
@@@ -972,9 -968,9 +973,9 @@@
  	}
  
  	if (left)
- 		return ParseFailed;
+ 		return PARSE_FAILED;
  
- 	return unknown ? ParseUnknown : ParseOK;
+ 	return unknown ? PARSE_UNKNOWN : PARSE_OK;
  }
  
  void rtw_macaddr_cfg(struct device *dev, u8 *mac_addr)
@@@ -1012,20 -1008,25 +1013,25 @@@ static int rtw_get_cipher_info(struct w
  	int group_cipher = 0, pairwise_cipher = 0, is8021x = 0;
  	int ret = _FAIL;
  
- 	pbuf = rtw_get_wpa_ie(&pnetwork->network.ies[12], &wpa_ielen, pnetwork->network.ie_length-12);
+ 	pbuf = rtw_get_wpa_ie(&pnetwork->network.ies[12],
+ 			      &wpa_ielen,
+ 			      pnetwork->network.ie_length - 12);
  
  	if (pbuf && (wpa_ielen > 0)) {
- 		if (rtw_parse_wpa_ie(pbuf, wpa_ielen+2, &group_cipher, &pairwise_cipher, &is8021x) == _SUCCESS) {
+ 		if (rtw_parse_wpa_ie(pbuf, wpa_ielen + 2, &group_cipher,
+ 				     &pairwise_cipher, &is8021x) == _SUCCESS) {
  			pnetwork->bcn_info.pairwise_cipher = pairwise_cipher;
  			pnetwork->bcn_info.group_cipher = group_cipher;
  			pnetwork->bcn_info.is_8021x = is8021x;
  			ret = _SUCCESS;
  		}
  	} else {
- 		pbuf = rtw_get_wpa2_ie(&pnetwork->network.ies[12], &wpa_ielen, pnetwork->network.ie_length-12);
+ 		pbuf = rtw_get_wpa2_ie(&pnetwork->network.ies[12], &wpa_ielen,
+ 				       pnetwork->network.ie_length - 12);
  
  		if (pbuf && (wpa_ielen > 0)) {
- 			if (rtw_parse_wpa2_ie(pbuf, wpa_ielen+2, &group_cipher, &pairwise_cipher, &is8021x) == _SUCCESS) {
+ 			if (rtw_parse_wpa2_ie(pbuf, wpa_ielen + 2, &group_cipher,
+ 					      &pairwise_cipher, &is8021x) == _SUCCESS) {
  				pnetwork->bcn_info.pairwise_cipher = pairwise_cipher;
  				pnetwork->bcn_info.group_cipher = group_cipher;
  				pnetwork->bcn_info.is_8021x = is8021x;
@@@ -1094,21 -1095,21 +1100,21 @@@ u16 rtw_mcs_rate(u8 bw_40MHz, u8 short_
  	u16 max_rate = 0;
  
  	if (MCS_rate[0] & BIT(7))
- 		max_rate = (bw_40MHz) ? ((short_GI)?1500:1350):((short_GI)?722:650);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 1500 : 1350) : ((short_GI) ? 722 : 650);
  	else if (MCS_rate[0] & BIT(6))
- 		max_rate = (bw_40MHz) ? ((short_GI)?1350:1215):((short_GI)?650:585);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 1350 : 1215) : ((short_GI) ? 650 : 585);
  	else if (MCS_rate[0] & BIT(5))
- 		max_rate = (bw_40MHz) ? ((short_GI)?1200:1080):((short_GI)?578:520);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 1200 : 1080) : ((short_GI) ? 578 : 520);
  	else if (MCS_rate[0] & BIT(4))
- 		max_rate = (bw_40MHz) ? ((short_GI)?900:810):((short_GI)?433:390);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 900 : 810) : ((short_GI) ? 433 : 390);
  	else if (MCS_rate[0] & BIT(3))
- 		max_rate = (bw_40MHz) ? ((short_GI)?600:540):((short_GI)?289:260);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 600 : 540) : ((short_GI) ? 289 : 260);
  	else if (MCS_rate[0] & BIT(2))
- 		max_rate = (bw_40MHz) ? ((short_GI)?450:405):((short_GI)?217:195);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 450 : 405) : ((short_GI) ? 217 : 195);
  	else if (MCS_rate[0] & BIT(1))
- 		max_rate = (bw_40MHz) ? ((short_GI)?300:270):((short_GI)?144:130);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 300 : 270) : ((short_GI) ? 144 : 130);
  	else if (MCS_rate[0] & BIT(0))
- 		max_rate = (bw_40MHz) ? ((short_GI)?150:135):((short_GI)?72:65);
+ 		max_rate = (bw_40MHz) ? ((short_GI) ? 150 : 135) : ((short_GI) ? 72 : 65);
  
  	return max_rate;
  }