Re: [PATCH] nfc: nci: fix OOB heap read in nci_core_init_rsp_packet_v2()

[Simon Horman <horms@kernel.org>]

On Sat, Apr 04, 2026 at 08:00:49PM +0200, Lekë Hapçiu wrote:
> From: Lekë Hapçiu <framemain@outlook.com>
> 
> nci_core_init_rsp_packet_v2() walks the chip-supplied
> supported_rf_interfaces[] flexible array using a plain pointer
> with no bounds check.  Each iteration advances supported_rf_interface
> by (1 + 1 + rf_extension_cnt) bytes, where rf_extension_cnt comes
> directly from the chip.  A hostile NCI v2 chip can set
> rf_extension_cnt=255 per entry and num_supported_rf_interfaces=4,
> driving the pointer up to ~1028 bytes past the end of the skb into
> adjacent kernel heap.
> 
> Add two guards per loop iteration:
>  - check that at least 2 bytes remain before reading the interface
>    byte and extension count byte;
>  - check that sufficient bytes remain for the declared extension
>    block before advancing over it.
> 
> Also add an upfront sizeof(*rsp) check so that accessing the fixed
> header fields (nfcc_features, max_logical_connections, ...) is safe
> before the loop is reached.
> 
> Fixes: bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence")
> Signed-off-by: Lekë Hapçiu <framemain@outlook.com>

I believe that my review of "[PATCH] nfc: nci: fix OOB heap read in
nci_core_init_rsp_packet_v1()" is relevant here.

- https://lore.kernel.org/all/20260408190505.GK469338@kernel.org/

I would appreciate it if you could create a v2 patchset, including
an updated version of this patch and that one.

Thanks!

-- 
pw-bot: changes-requested