From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AB46426ED6 for ; Thu, 11 Jun 2026 16:27:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781195247; cv=none; b=PUljJsZXi81uU1Bui38H55z8FaiomNRHK/y7NkudzO3rtXPHCxN9ugmAY/9BnBjK0UADYGgWLIN5ywiBM1IDKhsGUdKZtXmiuFfkENqAJVYZDJdo5PQ1TBsZ5labK7dc9TIDcWf8jFM2oqFZMb3arlWB9dKbDAeV0Nt8JiBNWAc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781195247; c=relaxed/simple; bh=A8tMHRZ+jlwjkwTJ703+ZnI5YYR5LiNC6BgBVzaV7sU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JgqD/j+LVqGDC7OeMT/3sPp8jJYYGaYjznveX+5MJj6A4HVf7pWp4BsTrmyoYTS2E6qXG4sHgoIB2lfW5MUdFLutU48Zpx0A/eESJCLOd4kfGII8wFZf80hJkg+g/JAy4hXRDhMQTlPEFNVDb1aB6W/fR8EDfisWkJsCXL3RVa8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xs6XbelL; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xs6XbelL" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-45ef5b33e73so2728f8f.1 for ; Thu, 11 Jun 2026 09:27:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781195241; x=1781800041; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KkKnjsGGzb7NsTQucsijuq+HFGUV8ktC3DxrHhupXYA=; b=Xs6XbelLYzLmrFvcTwifisxbRuBjCQ7pRQIv+EPghzMn2A89yjtTOgVvRYLPhS68/M d2oQyM+jq0fG57XtmGW0NvZI9nLgjtOPSl5owZGTN4jPzE5AF56X4YMDxBut0qRPl2Au M/Yl1mgAipKzyLsAoYd4wkYbh6H2d3sxnjJJkmXR3YPQQghgVESjxzYLwq7E59EmnHDB uPcMZmojOG239FdbDjYqt9OpyzakTT4y8ktyumXZPAMe/TLqvghEpF/wZHpuLhUiJooY 1SYOWjmVQwfVj7mzWge67L7nOo2lVq6ThosyhEyif6GjAfXiGLVCQEMtTgWVtyWUciFA Q2UA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781195241; x=1781800041; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KkKnjsGGzb7NsTQucsijuq+HFGUV8ktC3DxrHhupXYA=; b=sGtq3Dk4hSqbykoPWS06I4Ob1weAl9f6h/s/pBCbDj2a4CEHZgZ6TRBh/EYXb/9GnO D47djQ6xKaHWg2jgqiQqG+drPBVVjguvc+V0CCHJI0UtmJ0m/XotiGKoZ+b3Mvbh3fFQ lJp97681y8JBrI5HHDO/Ru9efRBcTmiXRyzxIjDGu0QzLZxkGhVrtiyQPppnqRpBiZ0z s6nSAW7uhbXuC9ZRgwkf4rh8DiIbWs04/SklEwm7TgopW5YemBe1GeLtj1cPPOL983X6 GerJxeLyG3dujuckQyAS1r4qcXODJohEKtPpr2jK69F81K8+i14VaubayXvzw2oefFjA 4fNQ== X-Forwarded-Encrypted: i=1; AFNElJ84nAF5oxywzry6HnxZrAd0IZrT4K5rRSwUundl5pYqN1smAvUEQR0iH0wat1KBKqgYOKDmPCTgRhsPJ3w=@vger.kernel.org X-Gm-Message-State: AOJu0YxwD+N2g13L0S4dbNwXiYwezsXZJ0ZDWkkglZmwMCjnIRlhp8F+ 6nxHnrBLwHEBWSWdz7++cTL/wki0uyfeSKn8GJ7DXWx3FSvwjQMMc0Wu X-Gm-Gg: Acq92OGbYhj4QLiIJuNLjnzlQ8gJejv3IvkaaZ9OjcSm6CW/wQIjFgIYzYXSL80p+87 aObwwRp/Zi+X5UVlVEwcfRl6VJZUHY+lUGCOBe1PiNqsicsfTRDtINi1rZc+CufuSoPo5uzQ3mj +MwKujXM1uYUGd0goqSL7+Q/aVBa+Gvrq4uvUQwoqdWEQBkpA4Yv68mLcjmSPs+1RnVrC3N8LR4 MF18Un4f7rIw02nropvYH6SAzr56IOb10m4l7f6BOnIUZiTBH6GwHE19GtazeBVGc1nVHFi2Rl1 ZjYrAljWDsAWR7ZrO0abNYqRuaObye2w3B6M/zQPPD+CTfbGJhrfUl4l8ilwneAZ9mfBv6ct9Nl cbg/is9oXB7ORjE6ccbXDsKc/k16TZapM8HZZhN517aquSZp58CMnJ0IVioGw1xzhGR3oc5HOOf u2AWg7+p1cXPlH1CGYXWHR5Fahi5CtwSuFfTamdP8RfXv5uinaybxuOOPGFFLaTrGadW9y2YCKI kBwByU= X-Received: by 2002:a05:600c:4443:b0:490:e190:39b1 with SMTP id 5b1f17b1804b1-490e564075dmr23542205e9.7.1781195241107; Thu, 11 Jun 2026 09:27:21 -0700 (PDT) Received: from ast-epyc5.inf.ethz.ch (ast-epyc4.inf.ethz.ch. [129.132.161.179]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-490e52ac9aasm64984155e9.4.2026.06.11.09.27.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Jun 2026 09:27:20 -0700 (PDT) From: Zijing Yin To: David Heidelberg Cc: Zijing Yin , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net] nfc: nci: validate packet length when parsing NCI 2.x RF interfaces Date: Thu, 11 Jun 2026 09:27:16 -0700 Message-ID: <20260611162718.2301552-1-yzjaurora@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nci_core_init_rsp_packet_v2() parses the variable-length list of supported RF interfaces carried in an NCI 2.x CORE_INIT_RSP without ever validating the controller-supplied lengths against the size of the received packet. Each list entry is a (RF interface, RF extension count, RF extensions[]) tuple. The loop walks the list using the per-entry extension count (rf_extension_cnt, up to 255) taken straight from the packet, so a malformed CORE_INIT_RSP can advance the read pointer far past the end of the skb data buffer. The stored interface count is clamped to NCI_MAX_SUPPORTED_RF_INTERFACES so the write side is bounded, but the read side runs off the end of the buffer. A malformed CORE_INIT_RSP from the controller, also reachable from user space through the virtual NCI device (CONFIG_NFC_VIRTUAL_NCI) once the device has entered NCI 2.x mode, therefore makes the parser read past the end of the response buffer while walking the interface list, copying the out-of-bounds bytes into ndev->supported_rf_interfaces[]. Reject responses shorter than the fixed part of the structure, and make sure each interface entry and its extension bytes lie within the received packet before dereferencing them. A truncated or malformed list is treated as a syntax error, which fails the CORE_INIT request instead of reading out of bounds. Fixes: bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence") Cc: stable@vger.kernel.org Signed-off-by: Zijing Yin --- net/nfc/nci/rsp.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c index 9eeb86282..152b5f57e 100644 --- a/net/nfc/nci/rsp.c +++ b/net/nfc/nci/rsp.c @@ -87,7 +87,8 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev, const struct sk_buff *skb) { const struct nci_core_init_rsp_nci_ver2 *rsp = (void *)skb->data; - const u8 *supported_rf_interface = rsp->supported_rf_interfaces; + const u8 *skb_end = skb->data + skb->len; + const u8 *supported_rf_interface; u8 rf_interface_idx = 0; u8 rf_extension_cnt = 0; @@ -96,6 +97,11 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev, if (rsp->status != NCI_STATUS_OK) return rsp->status; + if (skb->len < sizeof(*rsp)) + return NCI_STATUS_SYNTAX_ERROR; + + supported_rf_interface = rsp->supported_rf_interfaces; + ndev->nfcc_features = __le32_to_cpu(rsp->nfcc_features); ndev->num_supported_rf_interfaces = rsp->num_supported_rf_interfaces; @@ -104,10 +110,20 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev, NCI_MAX_SUPPORTED_RF_INTERFACES); while (rf_interface_idx < ndev->num_supported_rf_interfaces) { + /* The supported RF interfaces are a variable-length list of + * (interface, extension count, extensions[]) tuples supplied by + * the NFCC; bail out if its lengths would take us past the end + * of the received packet. + */ + if (skb_end - supported_rf_interface < 2) + return NCI_STATUS_SYNTAX_ERROR; + ndev->supported_rf_interfaces[rf_interface_idx++] = *supported_rf_interface++; /* skip rf extension parameters */ rf_extension_cnt = *supported_rf_interface++; + if (skb_end - supported_rf_interface < rf_extension_cnt) + return NCI_STATUS_SYNTAX_ERROR; supported_rf_interface += rf_extension_cnt; } -- 2.43.0