Skip to content

Commit f40ddcc

Browse files
Thadeu Lima de Souza Cascardokuba-moo
authored andcommitted
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
This reverts commit 068648a. NFC packets may have NUL-bytes. Checking for string length is not a correct assumption here. As long as there is a check for the length copied from copy_from_user, all should be fine. The fix only prevented the syzbot reproducer from triggering the bug because the packet is not enqueued anymore and the code that triggers the bug is not exercised. The fix even broke testing/selftests/nci/nci_dev, making all tests there fail. After the revert, 6 out of 8 tests pass. Fixes: 068648a ("nfc/nci: Add the inconsistency check between the input data length and count") Cc: stable@vger.kernel.org Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260113202458.449455-1-cascardo@igalia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent a92a6c5 commit f40ddcc

1 file changed

Lines changed: 0 additions & 4 deletions

File tree

drivers/nfc/virtual_ncidev.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,6 @@ static ssize_t virtual_ncidev_write(struct file *file,
125125
kfree_skb(skb);
126126
return -EFAULT;
127127
}
128-
if (strnlen(skb->data, count) != count) {
129-
kfree_skb(skb);
130-
return -EINVAL;
131-
}
132128

133129
nci_recv_frame(vdev->ndev, skb);
134130
return count;

0 commit comments

Comments
 (0)