Re: [PATCH net v2] nfc: nci: fix use of uninitialized memory in NFC-DEP general bytes

[David Heidelberg <david@ixit.cz>]

On 28/06/2026 23:49, Muhammad Bilal wrote:
> nci_store_general_bytes_nfc_dep() derives the length of the NFC-DEP
> general bytes by subtracting the fixed general-bytes offset from the ATR
> length:
> 
>    atr_res_len - NFC_ATR_RES_GT_OFFSET   (poll, offset 15)
>    atr_req_len - NFC_ATR_REQ_GT_OFFSET   (listen, offset 14)
> 
> It never checks that the ATR is at least that long.  When a
> RF_INTF_ACTIVATED_NTF reports an ATR shorter than the offset the
> subtraction is negative; because min_t() casts its arguments to __u8 the
> negative value becomes large and is then capped at
> NFC_ATR_RES_GB_MAXSIZE / NFC_ATR_REQ_GB_MAXSIZE.  remote_gb_len is thus
> set to up to 47/48 even though only atr_res_len/atr_req_len bytes of the
> on-stack atr_res/atr_req buffer were copied from the packet, and the
> following memcpy() reads the uninitialized remainder into
> ndev->remote_gb.
> 
> Zero remote_gb_len and skip storing the general bytes when the ATR is
> shorter than the general-bytes offset, so that a stale remote_gb_len
> from a previous activation does not survive into the new session.
> 
> Fixes: a99903ec4566 ("NFC: NCI: Handle Target mode activation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>   net/nfc/nci/ntf.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
> 
Hello Muhammad,

could you please rebase the patch on the currect version for-linus or for-next?

Thank you
David