Re: [PATCH] nfc: microread: validate target discovery payload lengths

[David Heidelberg]

On 01/07/2026 07:37, Pengpeng Hou wrote:
> microread_target_discovered() parses target discovery payloads from
> skb->data according to the HCI gate. The fixed field offsets and UID
> copies were checked only against the destination nfc_target buffers, not
> against the actual skb length.
>
> Validate that each gate-specific payload contains the fixed fields and
> UID bytes before reading or copying them.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>   drivers/nfc/microread/microread.c |   31 +++++++++++++++++++++++++++++--
>   1 file changed, 29 insertions(+), 2 deletions(-)

Hello Pengpeng,

thank you for your work!
May I ask you to add Fixes tag and Cc for stable kernels?

Thank you
David