kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

Mostly security fixes.

Browse source 
nci: add data_len bound checks to activation parameter extractors
 nci: fix double completion race in nci_data_exchange_complete
 nci: fix out-of-bounds write in nci_target_auto_activated()
 nci: fix uninit-value in the RF discover/activated NTF handlers
 nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
 nci: free destination parameters when closing a connection
 llcp: avoid userspace overflow on invalid optlen
 llcp: bound SNL TLV parsing to the skb and add length checks
 llcp: bound the connect_sn TLV walk to the skb
 llcp: fix OOB read and u8 offset wrap in TLV parsers
 llcp: read llcp_sock->local under the socket lock in getsockopt
 llcp: reject PDUs shorter than the LLCP header
 digital: Do not dump a NULL response in command completion
 digital: clamp SENSF_RES length to the destination buffer
 fdp: bound the device-reported read length and fix an skb leak
 microread: validate target discovery payload lengths
 pn533: hold a reference to the request skb during send_frame
 pn533: purge fragmented skbs during cleanup
 st21nfca: validate ATR_REQ length against the received frame
 
 Signed-off-by: David Heidelberg <david@ixit.cz>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE13oJz+7cK71TpwR0YAI/xNNJIHIFAmp7TEMACgkQYAI/xNNJ
 IHLe8A/+Nf5frmGy4C/J63sSWxFCvk1DXNp9zDkgQ5p5Tb2qcIxJzJsPeSyvQ7qG
 B3NUQ6vPxJu5alkiYGkqnpFIEedIHvHE3maFQB4vqMiuxUqNFhNEk2CjlQde5K3Y
 7exkGce57K/9ZkSp3wiz1OasCe0jI/Jo6wI1/t0oYXGo307OdGga39nXNtA1svha
 3a82+ViWoZaole+zGLZLl8mrtJQwooMiW7UXlEvvyggQndP728jtK3gcGwMmylyE
 tP8aDkJjcfe9L5TXHtom5NWEqN5PzzUu8qCGtnj9hC8OxOB3hFSyPeOvFwbiNbb7
 ZkfAKNz02ifjUFw9TTwwjZDiISVpDmti8bOO88hHmaS8FzIkDrEX6/XGcdJzRQvM
 r/5c7wBK6tlwaIRzVo2UtJ6E7fsRptTwmFXbCq4m1qzGrPJ4BefK8QAr0Dx6jk5h
 IeXaERxuZus2t/8OdwN2vQ8+fFMtfMXytGWScpCQmIe19zBzvM+fPg5CNwqd5sor
 ndNb1y8NjiifVAOdFuTS8023IPjQS2GRrMNaHiMP4t9Sht2ihScolzlCzhOYDw6Z
 cLn6bmIUTuXnkyP+xBrb2pi25myPAJ94gNDjyY7bQVrkeT6p8S9cob4deh4wyQfK
 GyAfIbVGQguL6KxR26Y2iX70iEJSCeB83+JtWNgWzDneSUiBwsY=
 =A3SJ
 -----END PGP SIGNATURE-----

Merge tag 'nfc-7.1-rc8' of https://codeberg.org/linux-nfc/linux

David Heidelberg says:

====================
Mostly security fixes.

nci: add data_len bound checks to activation parameter extractors
nci: fix double completion race in nci_data_exchange_complete
nci: fix out-of-bounds write in nci_target_auto_activated()
nci: fix uninit-value in the RF discover/activated NTF handlers
nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nci: free destination parameters when closing a connection
llcp: avoid userspace overflow on invalid optlen
llcp: bound SNL TLV parsing to the skb and add length checks
llcp: bound the connect_sn TLV walk to the skb
llcp: fix OOB read and u8 offset wrap in TLV parsers
llcp: read llcp_sock->local under the socket lock in getsockopt
llcp: reject PDUs shorter than the LLCP header
digital: Do not dump a NULL response in command completion
digital: clamp SENSF_RES length to the destination buffer
fdp: bound the device-reported read length and fix an skb leak
microread: validate target discovery payload lengths
pn533: hold a reference to the request skb during send_frame
pn533: purge fragmented skbs during cleanup
st21nfca: validate ATR_REQ length against the received frame

* tag 'nfc-7.1-rc8' of https://codeberg.org/linux-nfc/linux:
  nfc: microread: validate target discovery payload lengths
  nfc: nci: free destination parameters when closing a connection
  nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
  nfc: pn533: purge fragmented skbs during cleanup
  nfc: st21nfca: validate ATR_REQ length against the received frame
  nfc: llcp: bound the connect_sn TLV walk to the skb
  nfc: llcp: reject PDUs shorter than the LLCP header
  nfc: digital: Do not dump a NULL response in command completion
  nfc: pn533: hold a reference to the request skb during send_frame
  nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
  nfc: fdp: bound the device-reported read length and fix an skb leak
  nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
  nfc: nci: add data_len bound checks to activation parameter extractors
  nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
  nfc: llcp: bound SNL TLV parsing to the skb and add length checks
  nfc: digital: clamp SENSF_RES length to the destination buffer
  nfc: nci: fix double completion race in nci_data_exchange_complete
  nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
  nfc: llcp: avoid userspace overflow on invalid optlen
====================

Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-08-17 11:45:00 -07:00
commit a22054d743
12 changed files with 211 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files