Re: [PATCH net v4 0/5] nfc: fix multiple OOB reads in NCI and LLCP parsing paths

[David Heidelberg <david@ixit.cz>]

On 24/04/2026 20:01, Lekë Hapçiu wrote:
> This series fixes five out-of-bounds / underflow bugs in the kernel NFC
> stack.  All are reachable from a remote NFC peer that the local stack
> has already associated with; in the LLCP cases the peer only needs to
> send a malformed frame.
> 
>    1/5  nci: u8 underflow in nci_store_general_bytes_nfc_dep() lets the
>         attacker-controlled atr_res_len skip the GT-offset subtraction
>         and cause an OOB read/write against general_bytes[].
>    2/5  llcp: parse_gb_tlv() / parse_connection_tlv() trust the TLV
>         length byte without checking remaining buffer, and the tlv16
>         accessors read past the end when length < 2.
>    3/5  llcp: nfc_llcp_recv_snl() has the same TLV-length trust bug, and
>         its SDRES handler uses an unbounded "%.16s" pr_debug() that
>         walks past service_name_len.
>    4/5  llcp: nfc_llcp_recv_dm() reads skb->data[3] without checking
>         skb->len, giving a 1-byte heap OOB read.
>    5/5  llcp: nfc_llcp_connect_sn() walks the TLV array with no length
>         validation; a crafted CONNECT frame drops it into OOB reads /
>         an unbounded service-name pointer.
> 
> The series applies on top of net/main.
> 
> Lekë Hapçiu (5):
>    nfc: nci: fix u8 underflow in nci_store_general_bytes_nfc_dep
>    nfc: llcp: fix TLV parsing in parse_gb_tlv and parse_connection_tlv
>    nfc: llcp: fix TLV parsing OOB in nfc_llcp_recv_snl
>    nfc: llcp: fix OOB read of DM reason byte in nfc_llcp_recv_dm
>    nfc: llcp: fix TLV parsing OOB in nfc_llcp_connect_sn
> 
>   net/nfc/llcp_commands.c | 24 ++++++++++++++++++++++--
>   net/nfc/llcp_core.c     | 35 ++++++++++++++++++++++++++++++++---
>   net/nfc/nci/ntf.c       |  6 ++++++
>   3 files changed, 60 insertions(+), 5 deletions(-)
> 

Hello Lekë,

could you please rebase this series against NFC for-linus branch [1]?

Likely some checks has been added meanwhile, but I would love to get the 
remaining ones in!

Don't forget also add NFC mailing list oe-linux-nfc@lists.linux.dev .

Thank you
David