Re: [PATCH v4] nfc: hci: fix out-of-bounds read in HCP header parsing

[Simon Horman]

On Tue, Apr 14, 2026 at 05:24:10AM -0000, Ashutosh Desai wrote:
> nfc_hci_recv_from_llc() and nci_hci_data_received_cb() cast skb->data
> to struct hcp_packet and read the message header byte without checking
> that enough data is present in the linear sk_buff area. A malicious NFC
> peer can send a 1-byte HCP frame that passes through the SHDLC layer
> and reaches these functions, causing an out-of-bounds heap read.
> 
> Fix this by adding pskb_may_pull() before each cast to ensure the full
> 2-byte HCP header is pulled into the linear area before it is accessed.
> 
> Fixes: 8b8d2e08bf0d ("NFC: HCI support")
> Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ashutosh Desai <ashutoshdesai993@xxxxxxxxx>

Unfortunately this patch seems to be whitespace-damaged
and does not apply. Please address that and repost.

-- 
pw-bot: changes-requested