wireguard-linux/drivers/nfc/pn544, branch stable

nfc: fix use-after-free in nfc_get_local_general_bytes

2026-09-23T20:13:17Z

Commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") attempted to fix a use-after-free (UAF) issue by invoking nfc_llcp_local_put(local) after accessing local->gb. However, if the reference count drops to zero, local is freed immediately, leading to a use-after-free when callers access the returned pointer. Alternative approaches using dynamic allocation (e.g. kmemdup) introduced memory leaks because callers consistently treat the returned pointer as borrowed memory. Fix this properly by refactoring nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to accept a caller-provided output buffer (out_gb) and its maximum length (gb_max_len). The general bytes are safely copied into out_gb before calling nfc_llcp_local_put(local), ensuring safe lifetime management without ownership transfer complications. Update all callers across drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) to provide their own destination buffers and pass them to nfc_get_local_general_bytes(). Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei Reviewed-by: Simon Horman Link: https://patch.msgid.link/3cbaac3bee23f8ff3a3284ed32d347696eb1d208.1788841683.git.rakukuip@gmail.com Signed-off-by: David Heidelberg

nfc: Unify style of of_device_id arrays

2026-08-11T16:14:00Z

The most common style treewide is: - A single space in the list terminator and no trailing , - No comma after a named initializers iff the closing } is on the same line Adapt the of_device_id arrays accordingly. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Ian Ray Link: https://patch.msgid.link/583375dcd834f5edf6241b09cdd75ad4f32af668.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Drop __maybe_unused from of_device_id tables

2026-08-11T16:14:00Z

Referencing these arrays in MODULE_DEVICE_TABLE() is enough to convince the compiler that they are used even if the drivers are built-in (since 5ab23c7923a1 ("modpost: Create modalias for builtin modules"). So the __maybe_unused marking can be removed without introducing a compiler warning. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/031ea0ae38838df3261f844eb13e9841769b49a7.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Initialize mei_cl_device_idarrays using member names

2026-08-11T16:14:00Z

While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct mei_cl_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/cdc9bbac2e0743550970e565f57996c8a833446f.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: pn544: Drop empty line between i2c_device_id array and MODULE_DEVICE_TABLE()

2026-08-11T16:14:00Z

Usually there is no empty line between a module device table and the respective MODULE_DEVICE_TABLE(): $ git grep -h -B1 ^MODULE_DEVICE_TABLE v7.1-rc1 | sort | uniq -c | sort -n ... 1388 8129 }; 9784 -- (The `--` is part of grep output to separate the matches with their context from each other, that's not the most usual line before MODULE_DEVICE_TABLE(...).) Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/7562d0062948a474957d8d733c0e8a70de502624.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Unify style of acpi_device_id arrays

2026-08-11T16:13:59Z

Unify the style of the list terminator in acpi_device_id arrays, that is use a single space between { and }. This is the most common and generally recommended style for these. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/30cd94a6821917f16daffdce5fabf145432c13eb.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Initialize acpi_device_id arrays using member names

2026-08-11T16:13:59Z

While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct acpi_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Ian Ray Link: https://patch.msgid.link/5f60cd3e9831aac3995ed1a1b074ca1ae32e5286.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Drop unused assignment of acpi_device_id driver data

2026-08-11T16:13:59Z

The drivers explicitly set the .driver_data member of struct acpi_device_id to zero without relying on that value. Drop these unused assignments. This patch doesn't modify the compiled arrays, only their representation in source form benefits. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/c77f6376214001297f28d3ec48f0a853985f1847.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

nfc: Drop __maybe_unused from acpi_device_id tables

2026-08-11T16:13:59Z

Referencing these arrays in MODULE_DEVICE_TABLE() is enough to convince the compiler that they are used even if the drivers are built-in (since 5ab23c7923a1 ("modpost: Create modalias for builtin modules"). So the __maybe_unused marking can be removed without introducing a compiler warning. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/4c25d7a7f81d5117cd5d0de4a9f06ed0552e8793.1783091699.git.u.kleine-koenig@baylibre.com Signed-off-by: David Heidelberg

Replace by more specific (c files)

2026-07-03T05:38:17Z

Replace the #include of by the more specific where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)