Re: [PATCH v2] nfc: nci: ignore unexpected CORE_RESET_NTF and CORE_RESET_RSP

Hi David,

Thanks a lot for the pointer and explanation! I apologize for the
threading confusion — I mistakenly chained the v2 patch under the
previous review message using --in-reply-to.

I'll re-send the v2 patch as a clean, standalone thread right away so
that patchwork can track it properly, and I'll definitely adopt b4 for
future submissions.

Thanks again for keeping me on the right track!

Best regards,
Yuchao

David Heidelberg [off-list ref] 于2026年9月22日周二 18:05写道：

On 22/09/2026 10:07, Yuchao Zhang wrote:

quoted

Commit bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence")
added handling of CORE_RESET_NTF in nci_core_reset_ntf_packet(). When
received, it updates ndev->nci_ver, ndev->manufact_id, and
ndev->manufact_specific_info, and calls nci_req_complete(ndev,
NCI_STATUS_OK) to finish the pending reset request.

However, unlike other notification handlers in ntf.c (which validate
ndev->state before completing requests), nci_core_reset_ntf_packet()
does not check whether a core reset request is actually pending.
If an unsolicited or delayed CORE_RESET_NTF arrives (e.g. after a reset
command times out or from a misbehaving NFCC), it unconditionally:
1. Completes whatever request is currently in-flight (such as CORE_INIT,
    RF_DISCOVER, or CONN_CREATE) with NCI_STATUS_OK, leading to kernel
    state desynchronization.
2. Overwrites ndev->nci_ver and manufacturer info. Because
    ndev->nci_ver is used as a selector for subsequent packet formats
    and parsers (e.g., in nci_open_device() and nci_core_init_rsp_packet()),
    unexpectedly modifying it can cause protocol format confusion.

A similar issue exists in nci_core_reset_rsp_packet(): an unexpected or
delayed response packet can prematurely complete an unrelated in-flight
request.

Fix this by ensuring CORE_RESET_NTF and CORE_RESET_RSP are only processed
by the core layer when a reset command is actively awaiting them:
- Set NCI_RESET_PENDING in nci_reset_req() when sending CORE_RESET_CMD.
- In nci_core_reset_rsp_packet(), ignore the response if NCI_RESET_PENDING
   is not set. If set, clear the flag and complete the request on failure
   or for NCI 1.x (checking skb->len >= sizeof(*rsp)).
- In __nci_request(), ensure NCI_RESET_PENDING is cleared upon request
   completion, cancellation, or timeout.
- In nci_core_reset_ntf_packet(), skip power-on notifications (trigger
   0x01, identical in NCI 1.0 and 2.0), then check and clear
   NCI_RESET_PENDING before updating device fields and completing the
   request. The CORE_RESET_CMD trigger value is revision-dependent
   (0x00 in NCI 1.0, 0x02 in NCI 2.0), so both are accepted and gated
   on NCI_RESET_PENDING alone. If unexpected, log a warning and return
   0 so driver-specific handlers (such as fdp firmware patch handling)
   still receive the notification.

Fixes: bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <redacted>
---
v2:
  - Do not abort the notification pipeline on unexpected CORE_RESET_NTF (return 0
    instead of -EINVAL), preserving driver-level hooks (e.g. fdp firmware
    patching) per Simon Horman.
  - Skip power-on notifications (trigger 0x01, identical in NCI 1.0 and 2.0)
    while gating both NCI 1.0 (0x00) and NCI 2.0 (0x02) command-triggered resets
    on NCI_RESET_PENDING alone.
  - Check NCI_RESET_PENDING in nci_core_reset_rsp_packet() to avoid completing
    unrelated requests on unexpected responses.
  - Explicitly check skb->len >= sizeof(*rsp) in nci_core_reset_rsp_packet()
    for NCI 1.x handling.

Hello Yuchao,

please never send follow-ups as part of the thread. Always send them as a
separate message (otherwise they may get lost and we already have patchwork wich
can track the submissions.

Even better, try to use tools such as b4 to submit patches (easier for you, sent
in expected format for us).

Thanks
David