From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1F6541DEF8 for ; Mon, 20 Jul 2026 13:21:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784553700; cv=none; b=oznSO/K72Sz95o8uM2HVcAvlTQsHZa4+9pqswfWwirzKobMOQ4bM4ctnb1eGaZ2WurBjImbll8Gk+dzYnPTrsKto1AcV+7bZeTiYjtz5xAG5yuks5MMVpBGSv1crBRNHrrTioSPoY4yhGzZTzzHVTrSt8hUqfLRzJFCg3Y2Mdbc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784553700; c=relaxed/simple; bh=q/i+h1xLBAMF009p2KMCeNBKzps8J4NXn33rD07ylA0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=usaahENV8W9oXqz4IphSh+AITqjCjQPIzavJuLLRO8Y2/Ifb+iaJ6QPaF1NT4pFe01B1enza4GmeHj5vXZm4njFKEoXgwK5QLyafP+QEla/AlXlKhHJCXV37APtGg5+0jweH/5kQceu3lRSU6PlwINfGw/lnJJAdV2/F0BjT0j4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=GxVl9uIf; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="GxVl9uIf" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-49545ba3d4eso19435485e9.3 for ; Mon, 20 Jul 2026 06:21:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1784553697; x=1785158497; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=q/i+h1xLBAMF009p2KMCeNBKzps8J4NXn33rD07ylA0=; b=GxVl9uIfc3wggrB6zdYUthPXLOSiAarqT58441WgUkpw02w7lAkoOUuwzNp/OC+1U5 dq7WsyekZ2BkBd4pDh6Vf0y/mXsB0JDfxnwZob80UdPvh9ytPUAzdabaYCWa4ZSNbZO2 EVbDoovGMuNEtTv0Zzl6kqh5QqDLbD9tdwQzFrMk09B+Ltad3bU9fgl5FBh9k+ErUhWR CLPP+7bGt9aWifSCJdcp27w7l91drUhAG1k0B1nFiEwyGfL9ARoVEr+qKjyZl2JgZIja LpO0EQSv+pXMdt0qCjTpllxXeccZbXLFEASMZL5dFdCdvac5T+fjjVWnIQjNDc/EvOv/ ykMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784553697; x=1785158497; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=q/i+h1xLBAMF009p2KMCeNBKzps8J4NXn33rD07ylA0=; b=b9jYWc47wLQkKccFv3HbN/we4S/rGGd7xuG7Kd1n0NRiPkVTTkQA8vC9J7KkG2haKq zBgOARaNxpsT4beFQol27lxxxWdqOSv2ENrO2zRStpzCw7Np2owwtAO1DvXduaVClwrU N5Swcza/BNuZQdqwDj/DjaNad3ihvqNYGOVNL8CTdXxnk0tyeot9ut5K3hEGT1Zn81pO c4ilNXI1Uu6z+NO3a6hXwO2gn2fAbLmzlFB2heIBPnYG9iqk4c5zKcU5tvhYPfSl3o4W 00JK1J7ny9o+tfVaVBSZBCmN+YOBWi/dmuQb5Les93d6eXFA+JUSKMaAU7c5bMKUe/WV 0qXA== X-Forwarded-Encrypted: i=1; AHgh+RqK2mRa+5yLXbRrO2Z+x2Qtabv0GMxzxba/RY4kEHKyLuhDpr9/MK46OoCKDCt6V3ku4qSTtiHzip9BEeg=@vger.kernel.org X-Gm-Message-State: AOJu0YzyyfK13kQbs25TIkZS53f+dM4I0mlyRgG54ePe/JJzOSJmPgqd KoPIPmK05pwkxwMxcEKzxZXIDtbsYFUSlclA5QQTeFPzMueosv6oTpy/JkxEd+DlKExG X-Gm-Gg: AfdE7cnIsI5I48HEQcexf9f9MxyRisaA//NQMi6r6d0HqrUQxdPAW2VxDCDI2x/OkXK D0b/4RxPYBCLw4l0Bnwu5sCQpe/OvCKdefulzx5FO4iMXIffVlyjhH2FMK1HfSvPP+aq5NlnJsq WXH1qt6igUb/rEPJTAd+M5J4CjnMep7Ztxl1TMkUitpQfGWyDeUcZPpuR2fDJfML2MveINm0+A7 v9fuu+y8gXGrLvPPGCDU7dq24R26/av47AnM6R3irXuwftPxUQQY6ckiY+eR5cyTKaZGIDanCVs gDBEWyctODakSQSEcpxP/1+ieDLd9liOqUA6e/79cHmwpbY/0jxf1yOPq0uZcWLe2vBEz0/y0Q/ SvTD7OS4aeSuUZVE//Ku+YNnoNpX7moXRmGBrEXL4V1IozhXguHlTO1q6hdHPVa+4nuQdVAdvOC 9owsPpY8CTprXs+o9Fo7eE6ktcvv5gMO5Gd9sfYQniu8gS3jKHpfl58pb5TtQE3JGaWB6v6N9zI vjN2raPcTbBQGreKbMs724E X-Received: by 2002:a05:600c:198a:b0:495:6478:2dbc with SMTP id 5b1f17b1804b1-49564782e0fmr3937485e9.6.1784553696132; Mon, 20 Jul 2026 06:21:36 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.222.13]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4954a2b87c6sm509642335e9.7.2026.07.20.06.21.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 20 Jul 2026 06:21:35 -0700 (PDT) From: Doruk Tan Ozturk To: david@ixit.cz, horms@kernel.org Cc: oe-linux-nfc@lists.linux.dev, hexlabsecurity@proton.me, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net] nfc: fdp: bound the device-supplied read size in fdp_nci_i2c_read() Date: Mon, 20 Jul 2026 15:21:33 +0200 Message-ID: <20260720132133.69635-1-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 In-Reply-To: <879ab436-043a-450d-87c0-70e7c6f4ff8f@ixit.cz> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On 20/07/2026, David Heidelberg wrote: > I agree, I was looking at this patch yesterday and the current format > feels unfavorable. Please send next revision with Simon suggestion :) Will do. One heads-up before I resend: Bryam Vargas posted a v2 for the same bug back in June [1] that is more complete than mine. It also rejects len < FDP_NCI_I2C_MIN_PAYLOAD (the lower bound Simon flagged, reachable via the u16 truncation) and fixes an skb leak in the same loop, with a KASAN reproducer, and it carries Simon's Suggested-by. It looks like it just stalled. If you would rather pick that one up, it covers more than mine does. Happy to send my (narrower) v2 with Simon's suggestion if you prefer it instead, just let me know. -Doruk [1] https://lore.kernel.org/all/20260616-b4-disp-b1f8ab4c-v2-1-2d1fe5955325@proton.me/