linux-next: manual merge of the nfc tree with the nfc-fixes tree

linux-next: manual merge of the nfc tree with the nfc-fixes tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 1242 bytes --]

Hi all,

Today's linux-next merge of the nfc tree got a conflict in:

  net/nfc/nci/rsp.c

between commit:

  075f88b7d3b5c ("nfc: nci: fix uninit-value in nci_core_init_rsp_packet()")

from the nfc-fixes tree and commit:

  1d5fcb66b07a3 ("nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing")

from the nfc tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc net/nfc/nci/rsp.c
index 6b2fa6bdbd14b,85c3ff2b78cd9..0000000000000
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@@ -50,7 -50,8 +50,8 @@@ static u8 nci_core_init_rsp_packet_v1(s
  	const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
  	const struct nci_core_init_rsp_2 *rsp_2;
  
+ 	/* Ensure that the status field can be accessed. */
 -	if (skb_headlen(skb) < 1)
 +	if (skb->len < sizeof(*rsp_1))
  		return NCI_STATUS_SYNTAX_ERROR;
  
  	pr_debug("status 0x%x\n", rsp_1->status);

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the nfc tree with the nfc-fixes tree

[Zhou, Yun]

Hi Mark, David,

My patch (1d5fcb66b07a3) [1] was applied to the nfc tree on Jun 2, 
nearly a month before Samuel's (075f88b7d3b5c, Jun 24) [2] . They fix 
the same bug.

But Samuel's v2 still has issues that I addressed during my v1 [3] --> 
v3 iteration:
1. Error response handling: his patch requires sizeof(*rsp_1) before
reading the status field. A valid NCI error response may only contain
a 1-byte status — his code returns SYNTAX_ERROR instead of propagating
the device's actual error code. I fixed this in v2 [4] by checking 1 
byte first, then requiring the full header only after status == OK.

2. ndev state corruption: Simon flagged that if the length check fails
after ndev fields are partially updated, it leaves ndev in an
inconsistent state. My v3 defers all ndev updates until after
validation passes.

[1] 
https://lore.kernel.org/all/20260527052625.3309581-1-yun.zhou@windriver.com/T/
[2] https://lore.kernel.org/all/20260624224455.999374-1-sam@bynar.io/
[3] 
https://lore.kernel.org/all/20260519013042.3459906-1-yun.zhou@windriver.com/T/
[4] 
https://lore.kernel.org/all/20260522021326.1164807-1-yun.zhou@windriver.com/T/

Was there something wrong with my version, or was it just a mechanical 
conflict resolution?

Thanks,
Yun

On 6/29/2026 9:15 PM, Mark Brown wrote:
> Hi all,
> 
> Today's linux-next merge of the nfc tree got a conflict in:
> 
>    net/nfc/nci/rsp.c
> 
> between commit:
> 
>    075f88b7d3b5c ("nfc: nci: fix uninit-value in nci_core_init_rsp_packet()")
> 
> from the nfc-fixes tree and commit:
> 
>    1d5fcb66b07a3 ("nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing")
> 
> from the nfc tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> diff --cc net/nfc/nci/rsp.c
> index 6b2fa6bdbd14b,85c3ff2b78cd9..0000000000000
> --- a/net/nfc/nci/rsp.c
> +++ b/net/nfc/nci/rsp.c
> @@@ -50,7 -50,8 +50,8 @@@ static u8 nci_core_init_rsp_packet_v1(s
>    	const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
>    	const struct nci_core_init_rsp_2 *rsp_2;
>    
> + 	/* Ensure that the status field can be accessed. */
>   -	if (skb_headlen(skb) < 1)
>   +	if (skb->len < sizeof(*rsp_1))
>    		return NCI_STATUS_SYNTAX_ERROR;
>    
>    	pr_debug("status 0x%x\n", rsp_1->status);

Re: linux-next: manual merge of the nfc tree with the nfc-fixes tree

[David Heidelberg]

On 24/07/2026 05:18, Zhou, Yun wrote:
> Hi Mark, David,
> 
> My patch (1d5fcb66b07a3) [1] was applied to the nfc tree on Jun 2, nearly a 
> month before Samuel's (075f88b7d3b5c, Jun 24) [2] . They fix the same bug.
> 

Hello Yun,

thank you for noticing me.

> But Samuel's v2 still has issues that I addressed during my v1 [3] --> v3 
> iteration:
> 1. Error response handling: his patch requires sizeof(*rsp_1) before
> reading the status field. A valid NCI error response may only contain
> a 1-byte status — his code returns SYNTAX_ERROR instead of propagating
> the device's actual error code. I fixed this in v2 [4] by checking 1 byte first, 
> then requiring the full header only after status == OK.
> 
> 2. ndev state corruption: Simon flagged that if the length check fails
> after ndev fields are partially updated, it leaves ndev in an
> inconsistent state. My v3 defers all ndev updates until after
> validation passes.

Yes, now I see. I somehow must missed the part completely, maybe I looked at 
older revision when comparing these two patches approaches.

Conclusion: I'm re-picking the original patch in v3, and will drop the

nfc: nci: fix uninit-value in nci_core_init_rsp_packet()

Thank you both for the contribution and sorry for the complications!
David

> 
> [1] https://lore.kernel.org/all/20260527052625.3309581-1-yun.zhou@windriver.com/T/
> [2] https://lore.kernel.org/all/20260624224455.999374-1-sam@bynar.io/
> [3] https://lore.kernel.org/all/20260519013042.3459906-1-yun.zhou@windriver.com/T/
> [4] https://lore.kernel.org/all/20260522021326.1164807-1-yun.zhou@windriver.com/T/
> 
> Was there something wrong with my version, or was it just a mechanical conflict 
> resolution?
> 
> Thanks,
> Yun
> 
> On 6/29/2026 9:15 PM, Mark Brown wrote:
>> Hi all,
>>
>> Today's linux-next merge of the nfc tree got a conflict in:
>>
>>    net/nfc/nci/rsp.c
>>
>> between commit:
>>
>>    075f88b7d3b5c ("nfc: nci: fix uninit-value in nci_core_init_rsp_packet()")
>>
>> from the nfc-fixes tree and commit:
>>
>>    1d5fcb66b07a3 ("nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP 
>> parsing")
>>
>> from the nfc tree.
>>
>> I fixed it up (see below) and can carry the fix as necessary. This
>> is now fixed as far as linux-next is concerned, but any non trivial
>> conflicts should be mentioned to your upstream maintainer when your tree
>> is submitted for merging.  You may also want to consider cooperating
>> with the maintainer of the conflicting tree to minimise any particularly
>> complex conflicts.
>>
>> diff --cc net/nfc/nci/rsp.c
>> index 6b2fa6bdbd14b,85c3ff2b78cd9..0000000000000
>> --- a/net/nfc/nci/rsp.c
>> +++ b/net/nfc/nci/rsp.c
>> @@@ -50,7 -50,8 +50,8 @@@ static u8 nci_core_init_rsp_packet_v1(s
>>        const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
>>        const struct nci_core_init_rsp_2 *rsp_2;
>> +     /* Ensure that the status field can be accessed. */
>>   -    if (skb_headlen(skb) < 1)
>>   +    if (skb->len < sizeof(*rsp_1))
>>            return NCI_STATUS_SYNTAX_ERROR;
>>        pr_debug("status 0x%x\n", rsp_1->status);
> 

-- 
David Heidelberg