kernel/git/next/linux-next.git/drivers/nfc, branch master

nfc: port100: reject frames whose declared length exceeds the received data

2026-08-31T17:09:05+00:00

port100_recv_response() passes the URB transfer buffer to port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actual_length), so a device reporting a datalen larger than the received frame makes port100_data_checksum() read out of bounds past the transfer buffer. Reject a response whose declared frame size does not fit the received length before validating it. Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested. Fixes: 562d4d59b8a1 ("NFC: Sony Port-100 Series driver") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260711123651.32595-1-doruk@0sec.ai Signed-off-by: David Heidelberg

nfc: st21nfca: validate received frame size

2026-08-31T17:09:05+00:00

st21nfca_hci_i2c_repack() trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it unconditionally reads the byte after an escape marker. A malformed frame can place EOF immediately after the start marker or can end its data portion with an escape marker. The former leaves too few bytes for check_crc(), while the latter makes the unstuffing loop read past the current skb length. Require the minimum framing bytes both before and after unstuffing. Use separate input and output cursors while removing byte stuffing, and reject an escape marker without its encoded byte. This keeps malformed frames within the received frame boundary before CRC processing. Fixes: 3096e25a3e40 ("NFC: st21nfca: Fix incorrect byte stuffing revocation") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260715084405.41546-1-pengpeng@iscas.ac.cn Signed-off-by: David Heidelberg

nfc: nfcmrvl: validate helper command length before pull

2026-08-31T17:09:04+00:00

The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach the data access before the malformed packet is rejected. Validate the complete helper command length before stripping the NCI data header. Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn Signed-off-by: David Heidelberg

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18T17:42:41+00:00

Merge in late fixes in preparation for the net-next PR. Conflicts: drivers/dpll/dpll_core.c drivers/dpll/dpll_netlink.c 33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race") b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability") https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski

nfc: st95hf: switch to using sleeping variants of gpiod API

2026-08-11T16:14:01+00:00

The driver does not use gpiod API calls in an atomic context. Switch to gpiod_set_value_cansleep() calls to allow using the driver with GPIO controllers that might need process context to operate. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/amPsnh9wDIG2CeSi@google.com Signed-off-by: David Heidelberg

nfc: Unify style of usb_device_id arrays

2026-08-11T16:14:01+00:00

The usual coding style is to skip the comma after a initializer iff the closing } is on the same line. Also there is usually no empty line between the array and the MODULE_DEVICE_TABLE() macro. Adapt two drivers accordingly to match this common style. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/8a186cb0376deb3d4f4264e6ed351562b79bb53d.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Unify style of spi_device_id arrays

2026-08-11T16:14:00+00:00

Unify the style of the list terminator in spi_device_id arrays, that is use a single space between { and }. This is the most common and generally recommended style for these. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/78d632098fd42dbf2846cb89d66ec83bb9e1de99.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Initialize spi_device_idarrays using member names

2026-08-11T16:14:00+00:00

While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct spi_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/308a0d43ef042566ca595f1afa803cac592a4643.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Drop unused assignment of spi_device_id driver data

2026-08-11T16:14:00+00:00

The drivers explicitly set the .driver_data member of struct spi_device_id to zero without relying on that value. Drop these unused assignments. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/c645d5855d26307d6164122412335533febbf8b9.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Unify style of of_device_id arrays

2026-08-11T16:14:00+00:00

The most common style treewide is: - A single space in the list terminator and no trailing , - No comma after a named initializers iff the closing } is on the same line Adapt the of_device_id arrays accordingly. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Ian Ray Link: https://patch.msgid.link/583375dcd834f5edf6241b09cdd75ad4f32af668.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg