[pull-request] NFC fixes for net 7.3-rc5

[David Heidelberg <david@ixit.cz>]

The following changes since commit fd73f4a6659897191fa0d40695fe370925dd3780:

   Linux 7.3-rc3 (2026-09-13 14:38:02 -0700)

are available in the Git repository at:

   https://codeberg.org/linux-nfc/linux.git tags/nfc-7.3-rc5

for you to fetch changes up to b61732f47316d45f27706db7812950145d3327b5:

   nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (2026-09-23 
22:13:18 +0200)

----------------------------------------------------------------
NFC fixes for net 7.3-rc5

Mostly security fixes.

fix use-after-free in nfc_get_local_general_bytes
llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
llcp: Fix race condition in accept_queue lifecycle
llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
llcp: fix -ENOMEM on connect with zero-length service name
llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
llcp: fix sdreq TLV list leak on parse/alloc/send failure
llcp: fix slab-out-of-bounds reads when logging service names
selftests/nci: Fix out-of-bounds store on thread join
selftests: nci: Correct pthread_create return value check
selftests: nci: Fix uninitialized family ID on missing attribute
virtual_ncidev: Add missing ioctl compat handler
nfcmrvl: validate helper command length before pull
pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
port100: reject frames whose declared length exceeds the received data
st21nfca: validate ISO15693 inventory length
st21nfca: validate received frame size
trf7970a: power down on startup RX gain failure

Signed-off-by: David Heidelberg <david@ixit.cz>

----------------------------------------------------------------
Aamir Ahmed (1):
       nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

Aldo Ariel Panzardo (1):
       nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

Chaithanya Lagisetty (1):
       selftests: nci: Fix uninitialized family ID on missing attribute

Chris Gellermann (2):
       selftests/nci: Fix out-of-bounds store on thread join
       nfc: virtual_ncidev: Add missing ioctl compat handler

Cong Nguyen (1):
       nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

Deepanshu Kartikey (1):
       nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Doruk Tan Ozturk (1):
       nfc: port100: reject frames whose declared length exceeds the received data

Lee Jones (1):
       nfc: llcp: Fix race condition in accept_queue lifecycle

Lei Zhu (1):
       selftests: nci: Correct pthread_create return value check

Luxiao Xu (1):
       nfc: fix use-after-free in nfc_get_local_general_bytes

Myeonghun Pak (1):
       nfc: trf7970a: power down on startup RX gain failure

Pengpeng Hou (3):
       nfc: nfcmrvl: validate helper command length before pull
       nfc: st21nfca: validate received frame size
       nfc: st21nfca: validate ISO15693 inventory length

Ömer Mete Kaya (3):
       nfc: llcp: fix -ENOMEM on connect with zero-length service name
       nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
       nfc: llcp: fix slab-out-of-bounds reads when logging service names

  drivers/nfc/microread/microread.c     |   6 ++---
  drivers/nfc/nfcmrvl/fw_dnld.c         |  11 +++++---
  drivers/nfc/pn533/pn533.c             |  14 +++++-----
  drivers/nfc/pn533/pn533.h             |   4 ++-
  drivers/nfc/pn533/usb.c               |   4 ++-
  drivers/nfc/pn544/pn544.c             |   7 +++--
  drivers/nfc/port100.c                 |   7 +++++
  drivers/nfc/st21nfca/core.c           |  12 ++++-----
  drivers/nfc/st21nfca/i2c.c            |  29 +++++++++++++-------
  drivers/nfc/trf7970a.c                |   4 ++-
  drivers/nfc/virtual_ncidev.c          |   3 ++-
  include/net/nfc/hci.h                 |   2 +-
  include/net/nfc/nfc.h                 |   3 ++-
  net/nfc/core.c                        |  15 +++++------
  net/nfc/digital_dep.c                 |   8 +++---
  net/nfc/llcp.h                        |   1 +
  net/nfc/llcp_commands.c               |   2 +-
  net/nfc/llcp_core.c                   | 175 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------------------------
  net/nfc/llcp_sock.c                   |  65 
+++++++++++++++++++++++++++++++-------------
  net/nfc/nci/core.c                    |  10 +++----
  net/nfc/netlink.c                     |   7 +++--
  net/nfc/nfc.h                         |   3 ++-
  tools/testing/selftests/nci/nci_dev.c |  45 +++++++++++++++++++------------
  23 files changed, 289 insertions(+), 148 deletions(-)