[PATCH net] nfc: pn533: fix slab-out-of-bounds read in pn533_recv_frame()

[PATCH net] nfc: pn533: fix slab-out-of-bounds read in pn533_recv_frame()

[Chandradhar Kumar]

pn533_recv_frame() accesses skb->data to check for ACK frames, dump
the received frame via print_hex_dump_debug(), and validate the frame
without first verifying that skb->len contains enough bytes for the
frame header and payload. When a short or truncated USB packet is
received, this results in a slab-out-of-bounds read in
hex_dump_to_buffer() or during frame validation.

Fix this by verifying that skb->len is at least PN533_STD_FRAME_ACK_SIZE
before checking for an ACK frame, passing skb->len instead of the
unvalidated rx_frame_size() to print_hex_dump_debug(), and validating
that skb->len is large enough to hold the frame header and complete
frame before calling rx_is_frame_valid().

Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation")
Reported-by: syzbot+93f169a8e7d66864f800@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=93f169a8e7d66864f800
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
---
 drivers/nfc/pn533/pn533.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index b0133e51dce9..c730a84f1c62 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2193,6 +2193,13 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
 		goto sched_wq;
 	}
 
+	if (skb->len < PN533_STD_FRAME_ACK_SIZE) {
+		nfc_err(dev->dev, "Received a too short frame\n");
+		dev->cmd->status = -EIO;
+		dev_kfree_skb(skb);
+		goto sched_wq;
+	}
+
 	if (pn533_rx_frame_is_ack(skb->data)) {
 		dev_dbg(dev->dev, "%s: Received ACK frame\n", __func__);
 		dev_kfree_skb(skb);
@@ -2200,9 +2207,12 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
 	}
 
 	print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, skb->data,
-			     dev->ops->rx_frame_size(skb->data), false);
+			     skb->len, false);
 
-	if (!dev->ops->rx_is_frame_valid(skb->data, dev)) {
+	if (skb->len < PN533_STD_FRAME_HEADER_LEN + PN533_STD_FRAME_TAIL_LEN ||
+	    skb->len < dev->ops->rx_header_len ||
+	    skb->len < dev->ops->rx_frame_size(skb->data) ||
+	    !dev->ops->rx_is_frame_valid(skb->data, dev)) {
 		nfc_err(dev->dev, "Received an invalid frame\n");
 		dev->cmd->status = -EIO;
 	} else if (!pn533_rx_frame_is_cmd_response(dev, skb->data)) {
-- 
2.56.0

Re: [PATCH net] nfc: pn533: fix slab-out-of-bounds read in pn533_recv_frame()

[Chandradhar Kumar]

On Wed, Oct 14, 2026 at 02:02:36PM +0530, Chandradhar Kumar wrote:
> pn533_recv_frame() accesses skb->data to check for ACK frames, dump
> the received frame via print_hex_dump_debug(), and validate the frame
> without first verifying that skb->len contains enough bytes for the
> frame header and payload. When a short or truncated USB packet is
> received, this results in a slab-out-of-bounds read in
> hex_dump_to_buffer() or during frame validation.
> 
> Fix this by verifying that skb->len is at least PN533_STD_FRAME_ACK_SIZE
> before checking for an ACK frame, passing skb->len instead of the
> unvalidated rx_frame_size() to print_hex_dump_debug(), and validating
> that skb->len is large enough to hold the frame header and complete
> frame before calling rx_is_frame_valid().
> 
> Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation")
> Reported-by: syzbot+93f169a8e7d66864f800@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=93f169a8e7d66864f800
Hey the correspondig syzbot bug is opened for about a month would you
like to look into the patch if it is applicable or tell me if anything
is wrong in the patch or there are others way to fix the bug.

Thanks.
> Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
> ---
>  drivers/nfc/pn533/pn533.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
> index b0133e51dce9..c730a84f1c62 100644
> --- a/drivers/nfc/pn533/pn533.c
> +++ b/drivers/nfc/pn533/pn533.c
> @@ -2193,6 +2193,13 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
>  		goto sched_wq;
>  	}
>  
> +	if (skb->len < PN533_STD_FRAME_ACK_SIZE) {
> +		nfc_err(dev->dev, "Received a too short frame\n");
> +		dev->cmd->status = -EIO;
> +		dev_kfree_skb(skb);
> +		goto sched_wq;
> +	}
> +
>  	if (pn533_rx_frame_is_ack(skb->data)) {
>  		dev_dbg(dev->dev, "%s: Received ACK frame\n", __func__);
>  		dev_kfree_skb(skb);
> @@ -2200,9 +2207,12 @@ void pn533_recv_frame(struct pn533 *dev, struct sk_buff *skb, int status)
>  	}
>  
>  	print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, skb->data,
> -			     dev->ops->rx_frame_size(skb->data), false);
> +			     skb->len, false);
>  
> -	if (!dev->ops->rx_is_frame_valid(skb->data, dev)) {
> +	if (skb->len < PN533_STD_FRAME_HEADER_LEN + PN533_STD_FRAME_TAIL_LEN ||
> +	    skb->len < dev->ops->rx_header_len ||
> +	    skb->len < dev->ops->rx_frame_size(skb->data) ||
> +	    !dev->ops->rx_is_frame_valid(skb->data, dev)) {
>  		nfc_err(dev->dev, "Received an invalid frame\n");
>  		dev->cmd->status = -EIO;
>  	} else if (!pn533_rx_frame_is_cmd_response(dev, skb->data)) {
> -- 
> 2.56.0
>