netdev - Re: [PATCH RESEND net v3] net: nfc: nci: Add parameter validation for packet data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f95da89a-152d-4899-8068-3b6aab568825@redhat.com>
Date: Thu, 25 Sep 2025 10:45:14 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Deepak Sharma <deepak.sharma.472935@...il.com>, krzk@...nel.org,
 vadim.fedorenko@...ux.dev
Cc: netdev@...r.kernel.org, stable@...r.kernel.org,
 linux-kernel-mentees@...ts.linux.dev, linville@...driver.com,
 kuba@...nel.org, edumazet@...gle.com, juraj@...inay.com, horms@...nel.org,
 syzbot+740e04c2a93467a0f8c8@...kaller.appspotmail.com
Subject: Re: [PATCH RESEND net v3] net: nfc: nci: Add parameter validation for
 packet data

On 9/21/25 8:23 PM, Deepak Sharma wrote:
>  static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
> @@ -501,7 +536,7 @@ static int nci_store_general_bytes_nfc_dep(struct nci_dev *ndev,
>  	case NCI_NFC_A_PASSIVE_POLL_MODE:
>  	case NCI_NFC_F_PASSIVE_POLL_MODE:
>  		ndev->remote_gb_len = min_t(__u8,
> -			(ntf->activation_params.poll_nfc_dep.atr_res_len
> +					    (ntf->activation_params.poll_nfc_dep.atr_res_len
>  						- NFC_ATR_RES_GT_OFFSET),
>  			NFC_ATR_RES_GB_MAXSIZE);
>  		memcpy(ndev->remote_gb,
> @@ -513,7 +548,7 @@ static int nci_store_general_bytes_nfc_dep(struct nci_dev *ndev,
>  	case NCI_NFC_A_PASSIVE_LISTEN_MODE:
>  	case NCI_NFC_F_PASSIVE_LISTEN_MODE:
>  		ndev->remote_gb_len = min_t(__u8,
> -			(ntf->activation_params.listen_nfc_dep.atr_req_len
> +					    (ntf->activation_params.listen_nfc_dep.atr_req_len
>  						- NFC_ATR_REQ_GT_OFFSET),
>  			NFC_ATR_REQ_GB_MAXSIZE);
>  		memcpy(ndev->remote_gb,

I'm sorry for the late feedback. The above 2 chunks looks unrelated from
the real fix, please drop them: they will make stable teams work more
difficult for no good reason.

Thanks,

Paolo