]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
authorThadeu Lima de Souza Cascardo <cascardo@igalia.com>
Tue, 13 Jan 2026 20:24:58 +0000 (17:24 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 30 Jan 2026 09:27:34 +0000 (10:27 +0100)
commit93cbf6d80da2aaecabc5dd0b6745894b25238217
treedbc90757d2078b5f84fc1175085903084211113a
parent9367b4709b528b08c9a6c8b3f9519776d55c3413
Revert "nfc/nci: Add the inconsistency check between the input data length and count"

commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf upstream.

This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979.

NFC packets may have NUL-bytes. Checking for string length is not a correct
assumption here. As long as there is a check for the length copied from
copy_from_user, all should be fine.

The fix only prevented the syzbot reproducer from triggering the bug
because the packet is not enqueued anymore and the code that triggers the
bug is not exercised.

The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the
revert, 6 out of 8 tests pass.

Fixes: 068648aab72c ("nfc/nci: Add the inconsistency check between the input data length and count")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Link: https://patch.msgid.link/20260113202458.449455-1-cascardo@igalia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nfc/virtual_ncidev.c