Re: [PATCH net v3] nfc: llcp: fix slab-out-of-bounds reads when logging service names

[Simon Horman <horms@kernel.org>]

On Tue, Sep 08, 2026 at 07:12:38PM +0300, Ömer Mete Kaya wrote:
> 
> 
> On 9/8/26 18:41, Simon Horman wrote:
> > On Sun, Sep 06, 2026 at 03:38:08AM +0300, Ömer Mete Kaya wrote:
> >> nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-
> >> terminated strings to pr_debug() using the %s format specifier.
> >> The buffers are allocated via kmemdup() or come from netlink
> >> attributes and are not guaranteed to be null-terminated, causing
> >> __dynamic_pr_debug() to read beyond the allocated region:
> >>
> >>   KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
> >>
> >> Fix both call sites by using %.*s with the explicit length to limit
> >> the output to the actual length of the string.
> >>
> > 
> > As a patch for net, this needs a Fixes tag here
> > (no blank line between it and other tags).
> 
> Sorry, I know that but I wasnt sure whether to add it since the bug
> has been there since the function was introduced. I will add it in v4.

Understood. FTR, yes, a Fixes tag is needed in such cases.
The idea is to guide backporting of the patch to all versions
that are effected.

> >> @@ -135,7 +135,7 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri,
> >>  {
> >>  	struct nfc_llcp_sdp_tlv *sdreq;
> >>  
> >> -	pr_debug("uri: %s, len: %zu\n", uri, uri_len);
> >> +	pr_debug("uri: %.*s, len: %zu\n", (int)uri_len, uri);
> > 
> > This does not compile because the trailing uri_len argument is now missing.
> 
> Sorry, I normally test-build before sending but this
> one slipped through.

Stuff happens :)