[GIT PULL] Staging driver fixes for 7.2-rc3

[Greg KH]

The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda:

  Linux 7.2-rc2 (2026-07-05 14:44:06 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git tags/staging-7.2-rc3

for you to fetch changes up to 1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344:

  staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (2026-07-07 13:43:27 +0200)

----------------------------------------------------------------
Staging driver fixes for 7.2-rc3

Here are some staging driver fixes for 7.2-rc3 for some reported bugs in
the vme_user and rtl8723bs drivers.  These include:
  - many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts
  - vme_user bugfixes to correctly validate some user-provided data

All of these have been in linux-next for a while with no reported
issues.

Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

----------------------------------------------------------------
Alexandru Hossu (8):
      staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
      staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
      staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
      staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
      staging: rtl8723bs: fix OOB write in HT_caps_handler()
      staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
      staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
      staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Christopher Mackle (1):
      staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()

Hao-Qun Huang (2):
      staging: vme_user: fix location monitor leak in fake bridge
      staging: vme_user: fix location monitor leak in tsi148 bridge

Michael Tautschnig (1):
      staging: vme_user: bound slave read/write to the kern_buf size

 drivers/staging/rtl8723bs/core/rtw_ieee80211.c    | 15 +++++++++++++++
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c     | 20 +++++++++++++++++++-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c    | 23 ++++++++++++++++++-----
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c |  8 ++++++++
 drivers/staging/rtl8723bs/os_dep/xmit_linux.c     |  6 ++++--
 drivers/staging/vme_user/vme_fake.c               |  8 ++++++++
 drivers/staging/vme_user/vme_tsi148.c             |  8 ++++++++
 drivers/staging/vme_user/vme_user.c               | 22 ++++++++++++++++++++++
 8 files changed, 102 insertions(+), 8 deletions(-)