averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "nfc/nci: Add the inconsistency check between the input data length and count"

Browse Source 
commit f40ddcc0c0 upstream.

This reverts commit 068648aab7.

NFC packets may have NUL-bytes. Checking for string length is not a correct
assumption here. As long as there is a check for the length copied from
copy_from_user, all should be fine.

The fix only prevented the syzbot reproducer from triggering the bug
because the packet is not enqueued anymore and the code that triggers the
bug is not exercised.

The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the
revert, 6 out of 8 tests pass.

Fixes: 068648aab7 ("nfc/nci: Add the inconsistency check between the input data length and count")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Link: https://patch.msgid.link/20260113202458.449455-1-cascardo@igalia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Thadeu Lima de Souza Cascardo
2026-01-30 10:27:34 +01:00
committed by Greg Kroah-Hartman
parent 9367b4709b
commit 93cbf6d80d
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/nfc/virtual_ncidev.c
-4
View File
@@ -125,10 +125,6 @@ static ssize_t virtual_ncidev_write(struct file *file,
kfree_skb(skb);
return -EFAULT;
}
if (strnlen(skb->data, count) != count) {
kfree_skb(skb);
return -EINVAL;
}
nci_recv_frame(vdev->ndev, skb);
return count;