Re: [PATCH net] nfc: llcp: bound the remaining LLCP TLV parsers to their buffers

[Simon Horman]

On Sat, Jul 11, 2026 at 03:42:10PM +0200, Doruk (0sec) wrote:
> > Would it make sense to either guard skb->len >= LLCP_HEADER_SIZE
> > before the two call sites, or take the same skb_tail_pointer() based
> > approach used in nfc_llcp_connect_sn()?
> 
> Thanks for the review Simon! I went with the first option in a separate patch,
> since I believe the missing minimum-length check affects every PDU type the
> dispatcher hands off, not just CONNECT/CC:
> 
> [PATCH net] nfc: llcp: guard against short PDUs in nfc_llcp_rx_skb()
> 
> It adds "if (skb->len < LLCP_HEADER_SIZE) return;" at the top of
> nfc_llcp_rx_skb(), so no handler can see a sub-header PDU and the
> "skb->len - LLCP_HEADER_SIZE" subtraction can no longer wrap. With that
> in place the connection-TLV parser's bound is safe. Happy to respin
> either patch if you'd prefer both changes squashed into one.

Thanks, a separate patch sounds like a reasonable approach to me.

...