[PATCH] nfc: nci: validate CORE_CONN_CREATE response length before reading fields

[Aamir Ahmed <elb12345@hotmail.co.uk>]

nci_core_conn_create_rsp_packet() casts skb->data to struct
nci_core_conn_create_rsp and accesses its conn_id,
max_ctrl_pkt_payload_len, and credits_cnt fields (offsets 1-3) when
the status byte is NCI_STATUS_OK.  However, the NCI transport layer
(nci_valid_size) only guarantees that the payload contains at least
one byte.  A malformed response with plen=1 and status=0 passes this
check, and the handler then reads three bytes past the valid payload,
using uninitialised slab data to populate the connection info that is
later used for NFC data exchange.

This can be triggered from userspace via the virtual_ncidev interface
by injecting a short CORE_CONN_CREATE_RSP frame.

Add a length check for the full response structure before accessing
any field beyond the status byte.

Fixes: 736bb9577407 ("NFC: nci: Support logical connections management")
Cc: stable@vger.kernel.org
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
---
 net/nfc/nci/rsp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index b0ab4f5acbce..72b748f0be9f 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -312,6 +312,10 @@ static void nci_core_conn_create_rsp_packet(struct nci_dev *ndev,
 	pr_debug("status 0x%x\n", status);
 
 	if (status == NCI_STATUS_OK) {
+		if (skb->len < sizeof(*rsp)) {
+			status = NCI_STATUS_SYNTAX_ERROR;
+			goto exit;
+		}
 		rsp = (struct nci_core_conn_create_rsp *)skb->data;
 
 		conn_info = devm_kzalloc(&ndev->nfc_dev->dev,
-- 
2.43.0