[pull-request] NFC fixes for net 7.1-rc8

[David Heidelberg]

The following changes since commit db2ddb87143519e20a95aa36c60b36107b736a58:

  Linux 7.2-rc7 (2026-08-09 14:54:50 -0700)

are available in the Git repository at:

  https://codeberg.org/linux-nfc/linux.git tags/nfc-7.1-rc8

for you to fetch changes up to 25519469972ef57c3edb1805dabd6c5612b90211:

  nfc: microread: validate target discovery payload lengths (2026-08-11 
18:10:04 +0200)

----------------------------------------------------------------
Mostly security fixes.

nci: add data_len bound checks to activation parameter extractors
nci: fix double completion race in nci_data_exchange_complete
nci: fix out-of-bounds write in nci_target_auto_activated()
nci: fix uninit-value in the RF discover/activated NTF handlers
nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nci: free destination parameters when closing a connection
llcp: avoid userspace overflow on invalid optlen
llcp: bound SNL TLV parsing to the skb and add length checks
llcp: bound the connect_sn TLV walk to the skb
llcp: fix OOB read and u8 offset wrap in TLV parsers
llcp: read llcp_sock->local under the socket lock in getsockopt
llcp: reject PDUs shorter than the LLCP header
digital: Do not dump a NULL response in command completion
digital: clamp SENSF_RES length to the destination buffer
fdp: bound the device-reported read length and fix an skb leak
microread: validate target discovery payload lengths
pn533: hold a reference to the request skb during send_frame
pn533: purge fragmented skbs during cleanup
st21nfca: validate ATR_REQ length against the received frame

Signed-off-by: David Heidelberg <david@xxxxxxx>

----------------------------------------------------------------
Breno Leitao (2):
      nfc: llcp: avoid userspace overflow on invalid optlen
      nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

Bryam Vargas (2):
      nfc: nci: add data_len bound checks to activation parameter extractors
      nfc: fdp: bound the device-reported read length and fix an skb leak

Doruk Tan Ozturk (5):
      nfc: digital: clamp SENSF_RES length to the destination buffer
      nfc: llcp: bound SNL TLV parsing to the skb and add length checks
      nfc: llcp: reject PDUs shorter than the LLCP header
      nfc: llcp: bound the connect_sn TLV walk to the skb
      nfc: st21nfca: validate ATR_REQ length against the received frame

Linmao Li (2):
      nfc: digital: Do not dump a NULL response in command completion
      nfc: nci: free destination parameters when closing a connection

Muhammad Bilal (1):
      nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers

Pengpeng Hou (1):
      nfc: microread: validate target discovery payload lengths

Samuel Page (2):
      nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
      nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

Xu Rao (1):
      nfc: pn533: purge fragmented skbs during cleanup

Yinhao Hu (1):
      nfc: pn533: hold a reference to the request skb during send_frame

Yun Zhou (1):
      nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

Zhenghang Xiao (1):
      nfc: nci: fix double completion race in nci_data_exchange_complete

 drivers/nfc/fdp/i2c.c             | 27 +++++++++++++++++++++++++++
 drivers/nfc/microread/microread.c | 31 +++++++++++++++++++++++++++++--
 drivers/nfc/pn533/pn533.c         | 22 ++++++++++++++++------
 drivers/nfc/st21nfca/dep.c        |  3 +++
 net/nfc/digital_core.c            |  2 +-
 net/nfc/digital_technology.c      |  2 ++
 net/nfc/llcp_commands.c           | 18 ++++++++++++++++--
 net/nfc/llcp_core.c               | 44 
++++++++++++++++++++++++++++++++------------
 net/nfc/llcp_sock.c               | 14 +++++++++++---
 net/nfc/nci/data.c                | 10 +++++-----
 net/nfc/nci/ntf.c                 | 36 ++++++++++++++++++++++++++++++------
 net/nfc/nci/rsp.c                 | 42 +++++++++++++++++++++++++++++++++++++++---
 12 files changed, 211 insertions(+), 40 deletions(-)