[PATCH net] nfc: pn533: fix slab-out-of-bounds read in pn533_recv_frame()

[PATCH net] nfc: pn533: fix slab-out-of-bounds read in pn533_recv_frame()

[Chandradhar Kumar]

pn533_recv_frame() accesses skb->data to check for ACK frames, dump
the received frame via print_hex_dump_debug(), and validate the frame
without first verifying that skb->len contains enough bytes for the
frame header and payload. When a short or truncated USB packet is
received, this results in a slab-out-of-bounds read in
hex_dump_to_buffer() or during frame validation.

Fix this by verifying that skb->len is at least PN533_STD_FRAME_ACK_SIZE
before checking for an ACK frame, passing skb->len instead of the
unvalidated rx_frame_size() to print_hex_dump_debug(), and validating
that skb->len is large enough to hold the frame header and complete
frame before calling rx_is_frame_valid().

Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation")
Reported-by: syzbot+93f169a8e7d66864f800@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=93f169a8e7d66864f800
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
---
 drivers/nfc/pn533/pn533.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index b0133e51dce9..c730a84f1c62 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2193,6 +2193,13 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
 		goto sched_wq;
 	}
 
+	if (skb->len < PN533_STD_FRAME_ACK_SIZE) {
+		nfc_err(dev->dev, "Received a too short frame\n");
+		dev->cmd->status = -EIO;
+		dev_kfree_skb(skb);
+		goto sched_wq;
+	}
+
 	if (pn533_rx_frame_is_ack(skb->data)) {
 		dev_dbg(dev->dev, "%s: Received ACK frame\n", __func__);
 		dev_kfree_skb(skb);
@@ -2200,9 +2207,12 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
 	}
 
 	print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, skb->data,
-			     dev->ops->rx_frame_size(skb->data), false);
+			     skb->len, false);
 
-	if (!dev->ops->rx_is_frame_valid(skb->data, dev)) {
+	if (skb->len < PN533_STD_FRAME_HEADER_LEN + PN533_STD_FRAME_TAIL_LEN ||
+	    skb->len < dev->ops->rx_header_len ||
+	    skb->len < dev->ops->rx_frame_size(skb->data) ||
+	    !dev->ops->rx_is_frame_valid(skb->data, dev)) {
 		nfc_err(dev->dev, "Received an invalid frame\n");
 		dev->cmd->status = -EIO;
 	} else if (!pn533_rx_frame_is_cmd_response(dev, skb->data)) {
-- 
2.56.0