From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7580931715A for ; Thu, 18 Jun 2026 03:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781751604; cv=none; b=QIuEsSNh5hPAIujoKNyKfO5GKEWmWU/BjETBLM8Io2FSwySdn6kbP6jucq2xMUR5tF/TcSAwFyi+WLaglkDnmVvk1/GXk9pODxmt808XVQfRXN2IdmXxsWUsAZhAhzRhpYXbqCvZo1F5j0hZwFHwp24HxvYGYUwAH1VrMogKpVs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781751604; c=relaxed/simple; bh=CuT+a18CLfmJ5ZbB4wRmdkcAmpr6RyXbEUHA51J+pnk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=aSYj5VanEy/8YYkqLJdZ6be0lngS1t3fi1S4a98kr/Snbywc294mxzGMDTgr5VpQWeA2htenaOhr3SkVvv7aQ4V5Z5hmYBSd9woc6sC9c+86wKcVmCxRovayed3yMKjhx17hp2FQRFbuV1l7XqLDIgnieoVd5MGC+d7cJ5VFHis= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lktagBpC; arc=none smtp.client-ip=209.85.160.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lktagBpC" Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-517760dc3c2so2563441cf.3 for ; Wed, 17 Jun 2026 20:00:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781751602; x=1782356402; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=LOHiSwSzDaStFdbx006ltHTupDOwXJ6n1kY4sYDIBGQ=; b=lktagBpCUBmf95lB+3Uq+Sq1OLEQwLINz8PkQ1w+nt4ay1SZxajBo3OvuPn78fd+GI Zl1QaJIK1u4wqzsDhNmECvTH1dkC8LxiWG/zP0H/lcH0TgY+RDswU828x6JSD+FcHixo v9jxH9vGCHRqY5cSZA3KSJSaqE8xLpI/kszBQZ/R+ESe0Kzs5cyZdKSlqeEzosrTvKi9 MMzDiTzyEPGnrtrxGF4KG1054I3A7LHD0JRYIlcv1iPpaJUfURbugXIthh6qMEJ1oes5 HLb6fG7Q2DwGHUCatBo9nk+zCkhX9WkX+z7E1QL6+4Je3QmtBXttEm4VIvtNr8u0Zcsl 5DEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781751602; x=1782356402; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=LOHiSwSzDaStFdbx006ltHTupDOwXJ6n1kY4sYDIBGQ=; b=XVWuakFWlYEp/qx6wIntdearcmpkiSk6QC/pA4e2H8PEq9RV5jphzYRCdLco7Ib/B7 YXnLvsG1abvjL94d6u3WAgCu4rmoxUzCKGF1LMPco2HgI3w4Fts083URqv7PutLX4l9/ TYi8j9ffAwWjhxFAeUnvRTLZcqmSSJnsHEI8F9EVMpRy8uKUpCqY0o+7YpLWmNqb+UPC zpkHA+UGWC9+/E+EDh7hJqgJWYBwvWoX5Z3EVdhPH8+8vB7MeK95pWa8nBbyUeX+Oi6z P0PfWHax2p7Xaio9B9CAn3At2hJuclwUBi/VQGsDGiOCKN1Na6fIVMga1XqP3dzPbj1X MHIA== X-Forwarded-Encrypted: i=1; AFNElJ8gwPTVMhVo59pn/JVinJtCtryTYoYTa1GJiZ2VB6aJBztf/72jS5Ua+c3KUHUYTTvkn+UprFmiGw4Hu9I=@vger.kernel.org X-Gm-Message-State: AOJu0YyeRM6la9LoOWNixrQRIGlzax5lv24rB0J7JlIHAPjpdK6O+Cek MWbZV0heyelFfY8r8Jgxtvl9rmt1ddS0tUjOArCZPIi5JMj4Ynu6V9Zi3/rXo+qnt8Q= X-Gm-Gg: Acq92OGXWA1rvAJh4sRJc2ASjAAMfa7PirWxexKUAvaQ0qhHLhYuVGtzagckicVL9pz wWfm8jbsOaNQSkY1dQ2CqfIVe8KC65AEWSAKWzgPTwHpJiT4bjKtg8m45DWmLiszKEmrT22usqc gvUJCEQbMKRWQJj5Sk47kyTHZ4I72m1yS2BJcxKFRxkFqlRMHDPERR0T+yd38kOUJekbu21RgPM 5YFJ630dgWJ+yZeJa/lHzOJvSKL56XHWFHnr/re9++mIX8QsDYUSKABqiEEpm2O08iMwqrRWN1l 5akraQSeCMGYyym3d4vtH5TSktJK6TpAZZb6kO6AhXIVDgbed1ZN9g7D960rUNK5Bs+Bl9Lkn05 xp+hgrIolur7+8wKR5wBHzL7g0hi5I3DUiXytCwbjOWWxLM0VddVKdZzqAyK3GTWFuGmO7AZvom 3I847Ve43eiawXebW3h3nmzq4f2dmQPnCe9zkZ9Jt4zlDXxvthg4wTgJ+zTfsXQO9DzbU6Lj0UJ uZjXdquuTnuKrXOBkUCjXeUawNG0YHS X-Received: by 2002:ac8:6f15:0:b0:517:9afa:8f93 with SMTP id d75a77b69052e-519a8ffc86amr102875021cf.46.1781751602163; Wed, 17 Jun 2026 20:00:02 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8db4ad6d976sm47519786d6.43.2026.06.17.20.00.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Jun 2026 20:00:01 -0700 (PDT) From: Michael Bommarito To: Krzysztof Kozlowski , Dan Carpenter Cc: Jakub Kicinski , Kees Cook , linux-kernel@vger.kernel.org Subject: [PATCH 0/2] nfc: pn533: bound device-supplied lengths in the receive path Date: Wed, 17 Jun 2026 22:59:51 -0400 Message-ID: <20260618025953.1878757-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit The PN533 receive path trusts several device-supplied length fields and reads past the received buffer when they exceed it. The receive skb is sized to the device's USB transfer length, so a malicious or counterfeit PN53x reader triggers out-of-bounds reads in the standard/ACR122 frame validators, in Type A target parsing (nfcid_len), and in the autopoll record walk. Michael Bommarito (2): nfc: pn533: bound device-supplied lengths in the receive path nfc: pn533: add KUnit tests for receive-path bounds drivers/nfc/pn533/Kconfig | 9 +++ drivers/nfc/pn533/pn533.c | 125 +++++++++++++++++++++++++++++++++++++- drivers/nfc/pn533/pn533.h | 3 +- drivers/nfc/pn533/usb.c | 12 +++- 4 files changed, 144 insertions(+), 5 deletions(-) -- 2.53.0