[PATCH] nfc/nci: Fix uninit-value issue in nci_ntf_packet

[Qianqiang Liu]

When an unsupported rf_tech_and_mode (0xe6) occurs in nci_rf_discover_ntf_packet,
the ntf.ntf_type may be assigned an uninitialized value.

To resolve this, use the __GFP_ZERO flag when calling alloc_skb(),
ensuring that skb->data is properly initialized.

Reported-by: syzbot+3f8fa0edaa75710cd66e@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=3f8fa0edaa75710cd66e
Tested-by: syzbot+3f8fa0edaa75710cd66e@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Qianqiang Liu <qianqiang.liu@xxxxxxx>
---
 drivers/nfc/virtual_ncidev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c
index 6b89d596ba9a..31da26287327 100644
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -117,7 +117,7 @@ static ssize_t virtual_ncidev_write(struct file *file,
 	struct virtual_nci_dev *vdev = file->private_data;
 	struct sk_buff *skb;
 
-	skb = alloc_skb(count, GFP_KERNEL);
+	skb = alloc_skb(count, GFP_KERNEL | __GFP_ZERO);
 	if (!skb)
 		return -ENOMEM;
 
-- 
2.47.0