On 17/09/2025 23:05, Deepak Sharma wrote:

This is v2 for the original patch, I realized soon after 
sending the patch that I missed the release of skb before
returning, apologies.

This does not belong to commit msg, but changelog.

Syzbot reported an uninit-value bug at nci_init_req for commit
5aca7966d2a7

This bug arises due to very limited and poor input validation
that was done at net/nfc/nci/core.c:1543. This validation only

"done at nci_valid_size()." instead. Line number change.

validates the skb->len (directly reflects size provided at the
userspace interface) with the length provided in the buffer
itself (interpreted as NCI_HEADER). This leads to the processing
of memory content at the address assuming the correct layout
per what opcode requires there. This leads to the accesses to
buffer of `skb_buff->data` which is not assigned anything yet

Missing full stop, also other places.

Following the same silent drop of packets of invalid sizes, at
net/nfc/nci/core.c:1543, I have added validation in the 

Pleas use imperative mood. See longer explanation here:
https://elixir.bootlin.com/linux/v6.16/source/Documentation/process/submitting-patches.rst#L94

`nci_nft_packet` which processes NFT packets and silently return
in case of failure of any validation check

Possible TODO: because we silently drop the packets, the
call to `nci_request` will be waiting for completion of request
and will face timeouts. These timeouts can get excessively logged
in the dmesg. A proper handling of them may require to export
`nci_request_cancel` (or propagate error handling from the
nft packets handlers)

Please add Fixes tag and Cc stable.

Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
Signed-off-by: Deepak Sharma <redacted>
---
 net/nfc/nci/ntf.c | 42 +++++++++++++++++++++++++++++++++

The patch itself looks correct.



Best regards,
Krzysztof