* [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
2026-08-07 16:28 [PATCH net 0/1] net/nfc: Fix Use-After-Free in nfc_llcp_general_bytes() Ren Wei
@ 2026-08-07 16:28 ` Ren Wei
2026-08-11 8:19 ` Simon Horman
0 siblings, 1 reply; 3+ messages in thread
From: Ren Wei @ 2026-08-07 16:28 UTC (permalink / raw)
To: oe-linux-nfc, netdev
Cc: david, davem, edumazet, kuba, pabeni, horms, pengpeng, kees,
error27, raoxu, dddddd, ian.ray, joe, kuniyu, linma, vega,
rakukuip, weir
From: Luxiao Xu <rakukuip@gmail.com>
commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
attempted to fix a use-after-free (UAF) issue by
invoking nfc_llcp_local_put(local) after accessing local->gb. However,
if the reference count dropped to zero, local was freed prematurely,
leading to a Use-After-Free when the returned pointer was accessed.
Alternative approaches using dynamic allocation (such as kmemdup) introduced
severe memory leaks and state inconsistency because callers consistently
treated the returned pointer as borrowed memory.
Fix this properly by refactoring nfc_llcp_general_bytes() and
nfc_get_local_general_bytes() to accept a caller-provided output buffer
(out_gb) and its maximum length (gb_max_len). The general bytes are
safely copied into out_gb BEFORE calling nfc_llcp_local_put(local),
ensuring safe lifetime management without ownership transfer complications.
Update all callers across drivers (microread, pn533, pn544, st21nfca,
digital_dep, and nci) to allocate local stack buffers of size
NFC_MAX_GT_LEN and pass them to nfc_get_local_general_bytes().
Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
drivers/nfc/microread/microread.c | 5 ++---
drivers/nfc/pn533/pn533.c | 10 +++++-----
drivers/nfc/pn533/pn533.h | 2 +-
drivers/nfc/pn544/pn544.c | 7 +++----
drivers/nfc/st21nfca/core.c | 5 ++---
include/net/nfc/hci.h | 2 +-
include/net/nfc/nfc.h | 2 +-
net/nfc/core.c | 10 +++++-----
net/nfc/digital_dep.c | 3 ++-
net/nfc/llcp_core.c | 18 ++++++++++++------
net/nfc/nci/core.c | 3 ++-
net/nfc/nfc.h | 2 +-
12 files changed, 37 insertions(+), 32 deletions(-)
diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c
index 4149c5d735bd..0f0a03da9ff4 100644
--- a/drivers/nfc/microread/microread.c
+++ b/drivers/nfc/microread/microread.c
@@ -251,9 +251,8 @@ static int microread_start_poll(struct nfc_hci_dev *hdev,
param[1] |= (1 << 1);
if ((im_protocols | tm_protocols) & NFC_PROTO_NFC_DEP_MASK) {
- hdev->gb = nfc_get_local_general_bytes(hdev->ndev,
- &hdev->gb_len);
- if (hdev->gb == NULL || hdev->gb_len == 0) {
+ nfc_get_local_general_bytes(hdev->ndev, hdev->gb, sizeof(hdev->gb), &hdev->gb_len);
+ if (hdev->gb_len == 0) {
im_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
tm_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
}
diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index d7bdbc82e2ba..b3ac3f31518d 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -1346,10 +1346,10 @@ static int pn533_poll_dep(struct nfc_dev *nfc_dev)
u8 *next, nfcid3[NFC_NFCID3_MAXSIZE];
u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
- if (!dev->gb) {
- dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
+ if (!dev->gb_len) {
+ nfc_get_local_general_bytes(nfc_dev, dev->gb, sizeof(dev->gb), &dev->gb_len);
- if (!dev->gb || !dev->gb_len) {
+ if (!dev->gb_len) {
dev->poll_dep = 0;
queue_work(dev->wq, &dev->rf_work);
}
@@ -1647,8 +1647,8 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev,
}
if (tm_protocols) {
- dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
- if (dev->gb == NULL)
+ nfc_get_local_general_bytes(nfc_dev, dev->gb, sizeof(dev->gb), &dev->gb_len);
+ if (dev->gb_len == 0)
tm_protocols = 0;
}
diff --git a/drivers/nfc/pn533/pn533.h b/drivers/nfc/pn533/pn533.h
index 09e35b8693f5..d3425fcfd557 100644
--- a/drivers/nfc/pn533/pn533.h
+++ b/drivers/nfc/pn533/pn533.h
@@ -166,7 +166,7 @@ struct pn533 {
struct timer_list listen_timer;
int cancel_listen;
- u8 *gb;
+ u8 gb[NFC_MAX_GT_LEN];
size_t gb_len;
u8 tgt_available_prots;
diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
index 9d0a16ac465e..098b29d9a68e 100644
--- a/drivers/nfc/pn544/pn544.c
+++ b/drivers/nfc/pn544/pn544.c
@@ -377,10 +377,9 @@ static int pn544_hci_start_poll(struct nfc_hci_dev *hdev,
return r;
if ((im_protocols | tm_protocols) & NFC_PROTO_NFC_DEP_MASK) {
- hdev->gb = nfc_get_local_general_bytes(hdev->ndev,
- &hdev->gb_len);
- pr_debug("generate local bytes %p\n", hdev->gb);
- if (hdev->gb == NULL || hdev->gb_len == 0) {
+ nfc_get_local_general_bytes(hdev->ndev, hdev->gb, sizeof(hdev->gb), &hdev->gb_len);
+ pr_debug("generate local bytes len %zu\n", hdev->gb_len);
+ if (hdev->gb_len == 0) {
im_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
tm_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
}
diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c
index fd39a05c9622..0f49bf6af522 100644
--- a/drivers/nfc/st21nfca/core.c
+++ b/drivers/nfc/st21nfca/core.c
@@ -351,10 +351,9 @@ static int st21nfca_hci_start_poll(struct nfc_hci_dev *hdev,
if (r < 0)
return r;
} else {
- hdev->gb = nfc_get_local_general_bytes(hdev->ndev,
- &hdev->gb_len);
+ nfc_get_local_general_bytes(hdev->ndev, hdev->gb, sizeof(hdev->gb), &hdev->gb_len);
- if (hdev->gb == NULL || hdev->gb_len == 0) {
+ if (hdev->gb_len == 0) {
im_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
tm_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
}
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 756c11084f65..86ed63e5d533 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -144,7 +144,7 @@ struct nfc_hci_dev {
data_exchange_cb_t async_cb;
void *async_cb_context;
- u8 *gb;
+ u8 gb[NFC_MAX_GT_LEN];
size_t gb_len;
unsigned long quirks;
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index c54df042db6b..cfb9111bdf4e 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -273,7 +273,7 @@ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
int nfc_set_remote_general_bytes(struct nfc_dev *dev,
const u8 *gt, u8 gt_len);
-u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, u8 *out_gb, size_t gb_max_len, size_t *gb_len);
int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
u32 result);
diff --git a/net/nfc/core.c b/net/nfc/core.c
index a92a6566e6a0..af7edf2687ef 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -280,9 +280,9 @@ static struct nfc_target *nfc_find_target(struct nfc_dev *dev, u32 target_idx)
int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
{
int rc = 0;
- u8 *gb;
- size_t gb_len;
struct nfc_target *target;
+ u8 gb[NFC_MAX_GT_LEN];
+ size_t gb_len = 0;
pr_debug("dev_name=%s comm %d\n", dev_name(&dev->dev), comm_mode);
@@ -301,7 +301,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
goto error;
}
- gb = nfc_llcp_general_bytes(dev, &gb_len);
+ nfc_get_local_general_bytes(dev, gb, sizeof(gb), &gb_len);
if (gb_len > NFC_MAX_GT_LEN) {
rc = -EINVAL;
goto error;
@@ -644,11 +644,11 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
}
EXPORT_SYMBOL(nfc_set_remote_general_bytes);
-u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len)
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, u8 *out_gb, size_t gb_max_len, size_t *gb_len)
{
pr_debug("dev_name=%s\n", dev_name(&dev->dev));
- return nfc_llcp_general_bytes(dev, gb_len);
+ return nfc_llcp_general_bytes(dev, out_gb, gb_max_len, gb_len);
}
EXPORT_SYMBOL(nfc_get_local_general_bytes);
diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084737..a0218497e82d 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1490,12 +1490,13 @@ static int digital_tg_send_atr_res(struct nfc_digital_dev *ddev,
struct digital_atr_req *atr_req)
{
struct digital_atr_res *atr_res;
+ u8 local_gb[NFC_MAX_GT_LEN];
struct sk_buff *skb;
u8 *gb, payload_bits;
size_t gb_len;
int rc;
- gb = nfc_get_local_general_bytes(ddev->nfc_dev, &gb_len);
+ gb = nfc_get_local_general_bytes(ddev->nfc_dev, local_gb, sizeof(local_gb), &gb_len);
if (!gb)
gb_len = 0;
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index dc65c719f35f..1ed0ecde5872 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -635,23 +635,29 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
return ret;
}
-u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
+u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *out_gb, size_t gb_max_len, size_t *general_bytes_len)
{
struct nfc_llcp_local *local;
+ if (!out_gb || !general_bytes_len)
+ return NULL;
+
+ *general_bytes_len = 0;
+
local = nfc_llcp_find_local(dev);
- if (local == NULL) {
- *general_bytes_len = 0;
+ if (local == NULL)
return NULL;
- }
nfc_llcp_build_gb(local);
- *general_bytes_len = local->gb_len;
+ if (local->gb && local->gb_len) {
+ *general_bytes_len = min_t(size_t, local->gb_len, gb_max_len);
+ memcpy(out_gb, local->gb, *general_bytes_len);
+ }
nfc_llcp_local_put(local);
- return local->gb;
+ return out_gb;
}
int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 5f46c4b5720f..d27fe4f8456a 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -780,9 +780,10 @@ static int nci_set_local_general_bytes(struct nfc_dev *nfc_dev)
{
struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
struct nci_set_config_param param;
+ u8 local_gb[NFC_MAX_GT_LEN];
int rc;
- param.val = nfc_get_local_general_bytes(nfc_dev, ¶m.len);
+ param.val = nfc_get_local_general_bytes(nfc_dev, local_gb, sizeof(local_gb), ¶m.len);
if ((param.val == NULL) || (param.len == 0))
return 0;
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 0b1e6466f4fb..6caec88f7400 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -49,7 +49,7 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
int nfc_llcp_register_device(struct nfc_dev *dev);
void nfc_llcp_unregister_device(struct nfc_dev *dev);
int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len);
-u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
+u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *out_gb, size_t gb_max_len, size_t *general_bytes_len);
int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
int nfc_llcp_local_put(struct nfc_llcp_local *local);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
2026-08-07 16:28 ` [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks Ren Wei
@ 2026-08-11 8:19 ` Simon Horman
0 siblings, 0 replies; 3+ messages in thread
From: Simon Horman @ 2026-08-11 8:19 UTC (permalink / raw)
To: Ren Wei
Cc: oe-linux-nfc, netdev, david, davem, edumazet, kuba, pabeni,
pengpeng, kees, error27, raoxu, dddddd, ian.ray, joe, kuniyu,
linma, vega, rakukuip
On Sat, Aug 08, 2026 at 12:28:51AM +0800, Ren Wei wrote:
> From: Luxiao Xu <rakukuip@gmail.com>
>
> commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
> attempted to fix a use-after-free (UAF) issue by
> invoking nfc_llcp_local_put(local) after accessing local->gb. However,
> if the reference count dropped to zero, local was freed prematurely,
> leading to a Use-After-Free when the returned pointer was accessed.
> Alternative approaches using dynamic allocation (such as kmemdup) introduced
> severe memory leaks and state inconsistency because callers consistently
> treated the returned pointer as borrowed memory.
>
> Fix this properly by refactoring nfc_llcp_general_bytes() and
> nfc_get_local_general_bytes() to accept a caller-provided output buffer
> (out_gb) and its maximum length (gb_max_len). The general bytes are
> safely copied into out_gb BEFORE calling nfc_llcp_local_put(local),
> ensuring safe lifetime management without ownership transfer complications.
>
> Update all callers across drivers (microread, pn533, pn544, st21nfca,
> digital_dep, and nci) to allocate local stack buffers of size
> NFC_MAX_GT_LEN and pass them to nfc_get_local_general_bytes().
>
> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>
Hi Ren,
Thanks for your patch.
I've provided some minor feedback below.
> diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c
> index 4149c5d735bd..0f0a03da9ff4 100644
> --- a/drivers/nfc/microread/microread.c
> +++ b/drivers/nfc/microread/microread.c
> @@ -251,9 +251,8 @@ static int microread_start_poll(struct nfc_hci_dev *hdev,
> param[1] |= (1 << 1);
>
> if ((im_protocols | tm_protocols) & NFC_PROTO_NFC_DEP_MASK) {
> - hdev->gb = nfc_get_local_general_bytes(hdev->ndev,
> - &hdev->gb_len);
> - if (hdev->gb == NULL || hdev->gb_len == 0) {
> + nfc_get_local_general_bytes(hdev->ndev, hdev->gb, sizeof(hdev->gb), &hdev->gb_len);
Please line wrap so that lines are 80 columns wide or less.
Likewise elsewhere in this patch.
> + if (hdev->gb_len == 0) {
> im_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
> tm_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
> }
...
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index dc65c719f35f..1ed0ecde5872 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -635,23 +635,29 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
> return ret;
> }
>
> -u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
> +u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, u8 *out_gb, size_t gb_max_len, size_t *general_bytes_len)
> {
> struct nfc_llcp_local *local;
>
> + if (!out_gb || !general_bytes_len)
> + return NULL;
> +
> + *general_bytes_len = 0;
> +
> local = nfc_llcp_find_local(dev);
> - if (local == NULL) {
> - *general_bytes_len = 0;
> + if (local == NULL)
> return NULL;
> - }
>
> nfc_llcp_build_gb(local);
>
> - *general_bytes_len = local->gb_len;
> + if (local->gb && local->gb_len) {
> + *general_bytes_len = min_t(size_t, local->gb_len, gb_max_len);
> + memcpy(out_gb, local->gb, *general_bytes_len);
> + }
x86_64 W=1 builds with GCC 16.1.0 warn that:
net/nfc/llcp_core.c: In function 'nfc_llcp_general_bytes':
net/nfc/llcp_core.c:653:13: warning: the comparison will always evaluate as 'true' for the address of 'gb' will never be NULL [-Waddress]
653 | if (local->gb && local->gb_len) {
| ^~~~~
In file included from net/nfc/llcp_core.c:15:
net/nfc/llcp.h:77:12: note: 'gb' declared here
77 | u8 gb[NFC_MAX_GT_LEN];
| ^~
>
> nfc_llcp_local_put(local);
>
> - return local->gb;
> + return out_gb;
> }
>
...
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
@ 2026-08-23 12:23 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-08-23 12:23 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp
::::::
:::::: Manual check reason: "linux-review patch is more than 7 days old, verify it wasn't already superseded"
::::::
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <006437e618b55acc0df69d94255244a490b11461.1786029423.git.rakukuip@gmail.com>
References: <006437e618b55acc0df69d94255244a490b11461.1786029423.git.rakukuip@gmail.com>
TO: Ren Wei <weir@nebusec.ai>
TO: oe-linux-nfc@lists.linux.dev
TO: netdev@vger.kernel.org
CC: david@ixit.cz
CC: davem@davemloft.net
CC: edumazet@google.com
CC: kuba@kernel.org
CC: pabeni@redhat.com
CC: horms@kernel.org
CC: pengpeng@iscas.ac.cn
CC: kees@kernel.org
CC: error27@gmail.com
CC: raoxu@uniontech.com
CC: dddddd@hust.edu.cn
CC: ian.ray@gehealthcare.com
CC: joe@dama.to
CC: kuniyu@google.com
CC: linma@zju.edu.cn
CC: vega@nebusec.ai
CC: rakukuip@gmail.com
CC: weir@nebusec.ai
Hi Ren,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Ren-Wei/nfc-llcp-Pass-caller-buffer-to-nfc_llcp_general_bytes-to-fix-UAF-and-memory-leaks/20260808-002851
base: net/main
patch link: https://lore.kernel.org/r/006437e618b55acc0df69d94255244a490b11461.1786029423.git.rakukuip%40gmail.com
patch subject: [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
:::::: branch date: 10 hours ago
:::::: commit date: 10 hours ago
config: arm-randconfig-r134-20260823 (https://download.01.org/0day-ci/archive/20260823/202608230701.proA2MNj-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 935bfc708590c60147a79c7df145bb6e68b1d388)
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260823/202608230701.proA2MNj-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202608230701.proA2MNj-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
>> net/nfc/llcp_core.c:653:13: warning: address of array 'local->gb' will always evaluate to 'true' [-Wpointer-bool-conversion]
653 | if (local->gb && local->gb_len) {
| ~~~~~~~^~ ~~
1 warning generated.
--
In file included from drivers/nfc/pn533/uart.c:17:
>> drivers/nfc/pn533/pn533.h:169:8: error: use of undeclared identifier 'NFC_MAX_GT_LEN'
169 | u8 gb[NFC_MAX_GT_LEN];
| ^~~~~~~~~~~~~~
1 error generated.
vim +/NFC_MAX_GT_LEN +169 drivers/nfc/pn533/pn533.h
9815c7cf22dacea Michael Thalmeier 2016-03-25 132
9815c7cf22dacea Michael Thalmeier 2016-03-25 133 struct pn533 {
9815c7cf22dacea Michael Thalmeier 2016-03-25 134 struct nfc_dev *nfc_dev;
9815c7cf22dacea Michael Thalmeier 2016-03-25 135 u32 device_type;
9815c7cf22dacea Michael Thalmeier 2016-03-25 136 enum pn533_protocol_type protocol_type;
9815c7cf22dacea Michael Thalmeier 2016-03-25 137
9815c7cf22dacea Michael Thalmeier 2016-03-25 138 struct sk_buff_head resp_q;
9815c7cf22dacea Michael Thalmeier 2016-03-25 139 struct sk_buff_head fragment_skb;
9815c7cf22dacea Michael Thalmeier 2016-03-25 140
9815c7cf22dacea Michael Thalmeier 2016-03-25 141 struct workqueue_struct *wq;
9815c7cf22dacea Michael Thalmeier 2016-03-25 142 struct work_struct cmd_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 143 struct work_struct cmd_complete_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 144 struct delayed_work poll_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 145 struct work_struct mi_rx_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 146 struct work_struct mi_tx_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 147 struct work_struct mi_tm_rx_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 148 struct work_struct mi_tm_tx_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 149 struct work_struct tg_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 150 struct work_struct rf_work;
9815c7cf22dacea Michael Thalmeier 2016-03-25 151
9815c7cf22dacea Michael Thalmeier 2016-03-25 152 struct list_head cmd_queue;
9815c7cf22dacea Michael Thalmeier 2016-03-25 153 struct pn533_cmd *cmd;
9815c7cf22dacea Michael Thalmeier 2016-03-25 154 u8 cmd_pending;
9815c7cf22dacea Michael Thalmeier 2016-03-25 155 struct mutex cmd_lock; /* protects cmd queue */
9815c7cf22dacea Michael Thalmeier 2016-03-25 156
9815c7cf22dacea Michael Thalmeier 2016-03-25 157 void *cmd_complete_mi_arg;
9815c7cf22dacea Michael Thalmeier 2016-03-25 158 void *cmd_complete_dep_arg;
9815c7cf22dacea Michael Thalmeier 2016-03-25 159
9815c7cf22dacea Michael Thalmeier 2016-03-25 160 struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
9815c7cf22dacea Michael Thalmeier 2016-03-25 161 u8 poll_mod_count;
9815c7cf22dacea Michael Thalmeier 2016-03-25 162 u8 poll_mod_curr;
9815c7cf22dacea Michael Thalmeier 2016-03-25 163 u8 poll_dep;
9815c7cf22dacea Michael Thalmeier 2016-03-25 164 u32 poll_protocols;
9815c7cf22dacea Michael Thalmeier 2016-03-25 165 u32 listen_protocols;
9815c7cf22dacea Michael Thalmeier 2016-03-25 166 struct timer_list listen_timer;
9815c7cf22dacea Michael Thalmeier 2016-03-25 167 int cancel_listen;
9815c7cf22dacea Michael Thalmeier 2016-03-25 168
68a67c03cdab6d4 Luxiao Xu 2026-08-08 @169 u8 gb[NFC_MAX_GT_LEN];
9815c7cf22dacea Michael Thalmeier 2016-03-25 170 size_t gb_len;
9815c7cf22dacea Michael Thalmeier 2016-03-25 171
9815c7cf22dacea Michael Thalmeier 2016-03-25 172 u8 tgt_available_prots;
9815c7cf22dacea Michael Thalmeier 2016-03-25 173 u8 tgt_active_prot;
9815c7cf22dacea Michael Thalmeier 2016-03-25 174 u8 tgt_mode;
9815c7cf22dacea Michael Thalmeier 2016-03-25 175
9815c7cf22dacea Michael Thalmeier 2016-03-25 176 struct pn533_frame_ops *ops;
9815c7cf22dacea Michael Thalmeier 2016-03-25 177
9815c7cf22dacea Michael Thalmeier 2016-03-25 178 struct device *dev;
9815c7cf22dacea Michael Thalmeier 2016-03-25 179 void *phy;
bc642817b6d9e05 Rikard Falkeborn 2021-10-07 180 const struct pn533_phy_ops *phy_ops;
9815c7cf22dacea Michael Thalmeier 2016-03-25 181 };
9815c7cf22dacea Michael Thalmeier 2016-03-25 182
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-23 12:23 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-23 12:23 [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2026-08-07 16:28 [PATCH net 0/1] net/nfc: Fix Use-After-Free in nfc_llcp_general_bytes() Ren Wei
2026-08-07 16:28 ` [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks Ren Wei
2026-08-11 8:19 ` Simon Horman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.