[PATCH 0/1] nfc: nci: do not process unexpected or invalid CORE_CONN_CREATE_RSP

[zjamg <ndaugoing@gmail.com>]

From: Yuchao Zhang <ndaugoing@gmail.com>

Hello,

This patch addresses several issues in the NCI core logical connection
handling where an unsolicited or malformed CORE_CONN_CREATE_RSP packet
can corrupt connection tracking, shadow the static RF connection, and
cause TX queue stalls or hung waiters.

Problem Overview:
=================
In the NCI core stack, logical connections can be created by sending
NCI_OP_CORE_CONN_CREATE_CMD to the NFCC, which answers with
NCI_OP_CORE_CONN_CREATE_RSP. nci_core_conn_create_rsp_packet() parses
this response and adds a new struct nci_conn_info to ndev->conn_info_list.

However, nci_core_conn_create_rsp_packet() had several vulnerabilities:
1. No Pending Command Check:
   It did not check whether a connection creation command was actually
   pending. An unsolicited or delayed CORE_CONN_CREATE_RSP packet
   unconditionally allocated and inserted a connection into
   ndev->conn_info_list, and called nci_req_complete(ndev, status),
   prematurely completing whatever unrelated request was in-flight.
2. Connection ID Collision & Shadowing:
   Dynamic logical connections allocated by the NFCC must not use
   NCI_STATIC_RF_CONN_ID (0x00) or collide with existing connections.
   Furthermore, nci_core_conn_create_rsp_packet() used list_add() to
   prepend the new connection to ndev->conn_info_list. Because
   connection lookups (e.g. in nci_tx_work() and
   nci_data_exchange_complete()) use first-match semantics, prepending
   allowed an injected connection with conn_id = 0 to shadow
   ndev->rf_conn_info. This caused:
   - Cross-connection credit accounting in nci_tx_work().
   - TX queue stall when credits == 0 (frame wedged without timer).
   - Dropped RX completion (cb == NULL on the rogue connection, hanging
     the real waiter registered by nci_transceive()).
3. Missing Length Validation:
   The handler accessed payload fields without checking whether
   skb->len >= sizeof(struct nci_core_conn_create_rsp), risking
   out-of-bounds reads.
4. Spurious HCI conn_info Assignment:
   ndev->hci_dev->conn_info was updated whenever cur_params.id matched
   hci_dev->nfcee_id. Because both default to 0, non-NFCEE connections
   (such as loopback) erroneously updated ndev->hci_dev->conn_info.

Solution:
=========
- Add an NCI_CONN_CREATE_PENDING flag in enum nci_flag to track
  in-flight connection creation commands, and reject unsolicited or
  delayed responses.
- Validate packet length before reading payload fields.
- Reject responses that allocate NCI_STATIC_RF_CONN_ID or duplicate
  existing connection IDs.
- Append new connections with list_add_tail() instead of list_add().
- Restrict ndev->hci_dev->conn_info assignment to NFCEE destination
  types.

Non-overlap with adjacent fixes:
================================
This issue does not overlap with the adjacent upstream fixes in this
area: Lin Ma's commit 1b1499a817c9 ("nfc: nci: fix the UAF of
rf_conn_info object") addresses a use-after-free in the conn_close
path, and Yun Zhou's commit d56575a2595e ("nfc: nci: fix use of
uninitialized memory in CORE_INIT_RSP parsing") addresses a different
packet. The problem fixed here is the list_add() head-insertion
combined with first-match lookup semantics (core.c:43-54), which lets
a forged connection shadow the real one.

Testing:
========
Verified with QEMU arm64 empirical test harness. Unsolicited
CORE_CONN_CREATE_RSP frames were rejected with a rate-limited warning;
conn_count remained 1, and the static RF connection was not shadowed.
Verified with module compilation and checkpatch.pl (0 errors, 0 warnings).

Thanks,
Yuchao Zhang

Yuchao Zhang (1):
  nfc: nci: do not process unexpected or invalid CORE_CONN_CREATE_RSP

 include/net/nfc/nci_core.h |  1 +
 net/nfc/nci/core.c         |  2 ++
 net/nfc/nci/rsp.c          | 37 ++++++++++++++++++++++++++++++-------
 3 files changed, 33 insertions(+), 7 deletions(-)

-- 
2.53.0