Merge tag 'nfc-7.1-rc8' of https://codeberg.org/linux-nfc/linux

David Heidelberg says:

====================
Mostly security fixes.

nci: add data_len bound checks to activation parameter extractors
nci: fix double completion race in nci_data_exchange_complete
nci: fix out-of-bounds write in nci_target_auto_activated()
nci: fix uninit-value in the RF discover/activated NTF handlers
nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nci: free destination parameters when closing a connection
llcp: avoid userspace overflow on invalid optlen
llcp: bound SNL TLV parsing to the skb and add length checks
llcp: bound the connect_sn TLV walk to the skb
llcp: fix OOB read and u8 offset wrap in TLV parsers
llcp: read llcp_sock->local under the socket lock in getsockopt
llcp: reject PDUs shorter than the LLCP header
digital: Do not dump a NULL response in command completion
digital: clamp SENSF_RES length to the destination buffer
fdp: bound the device-reported read length and fix an skb leak
microread: validate target discovery payload lengths
pn533: hold a reference to the request skb during send_frame
pn533: purge fragmented skbs during cleanup
st21nfca: validate ATR_REQ length against the received frame

* tag 'nfc-7.1-rc8' of https://codeberg.org/linux-nfc/linux:
  nfc: microread: validate target discovery payload lengths
  nfc: nci: free destination parameters when closing a connection
  nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
  nfc: pn533: purge fragmented skbs during cleanup
  nfc: st21nfca: validate ATR_REQ length against the received frame
  nfc: llcp: bound the connect_sn TLV walk to the skb
  nfc: llcp: reject PDUs shorter than the LLCP header
  nfc: digital: Do not dump a NULL response in command completion
  nfc: pn533: hold a reference to the request skb during send_frame
  nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
  nfc: fdp: bound the device-reported read length and fix an skb leak
  nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
  nfc: nci: add data_len bound checks to activation parameter extractors
  nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
  nfc: llcp: bound SNL TLV parsing to the skb and add length checks
  nfc: digital: clamp SENSF_RES length to the destination buffer
  nfc: nci: fix double completion race in nci_data_exchange_complete
  nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
  nfc: llcp: avoid userspace overflow on invalid optlen
====================

Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions