Re: [PATCH net 0/3] nfc: llcp: fix OOB reads in TLV parsers and PDU handlers

[Paolo Abeni <pabeni@redhat.com>]

On 4/10/26 1:35 AM, Lekë Hapçiu wrote:
> This series fixes three out-of-bounds read vulnerabilities in the NFC
> LLCP layer, all reachable from RF without prior pairing or session
> establishment.
> 
> Patch 1 adds missing TLV length bounds checks in nfc_llcp_parse_gb_tlv()
> and nfc_llcp_parse_connection_tlv() — a crafted CONNECT or SNL PDU
> containing a short TLV value field can read beyond the skb tail.
> 
> Patch 2 fixes nfc_llcp_recv_snl(), which accessed TLV fields and
> performed arithmetic on an uncapped length byte before any bounds
> check, enabling a 1-byte heap OOB read and a u8 wrap-around.
> 
> Patch 3 fixes nfc_llcp_recv_dm(), which read the DM reason byte at
> skb->data[2] without verifying the frame is at least 3 bytes long.
> A 2-byte DM PDU (header only) from a rogue peer triggers a 1-byte
> OOB heap read.
> 
> All three bugs are independently triggered via RF (AV:A, AC:L, no
> authentication required).

This series looks like an older iteration of:

https://patchwork.kernel.org/user/todo/netdevbpf/?series=1079400

but it reached the ML 2h afterwards?!?

At very best you have some serious setup issue. Please have a look at
the repost policy and especially at the 24h grace period:

https://elixir.bootlin.com/linux/v7.0/source/Documentation/process/maintainer-netdev.rst

And, given the above problem, please do not share any more patches for
at least 48h.

/P