* [PATCH net 1/2] nfc: digital: reserve proper headroom for chaining_skb
2026-09-12 13:18 [PATCH net 0/2] nfc: digital: fix two bugs in NFC-DEP chaining and frame handling Liu Chao
@ 2026-09-12 13:18 ` Liu Chao
2026-09-12 13:18 ` [PATCH net 2/2] nfc: digital: check resp length in digital_tg_send_atr_res_complete() Liu Chao
1 sibling, 0 replies; 3+ messages in thread
From: Liu Chao @ 2026-09-12 13:18 UTC (permalink / raw)
To: David Heidelberg
Cc: Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
David S . Miller, oe-linux-nfc, netdev, linux-kernel, Liu Chao,
stable
digital_recv_dep_data_gather() allocates chaining_skb with
nfc_alloc_recv_skb(), which only reserves 1 byte of headroom.
Once the chained payload is fully gathered, it is passed to
digital_tg_send_dep_res() or digital_in_send_dep_req(), both of
which push a 3-byte DEP header plus up to 2 bytes of SoD, needing
at least 5 bytes of headroom.
skb_push() unconditionally calls skb_under_panic() when headroom is
insufficient, so this is a guaranteed kernel BUG. A remote NFC peer
can trigger it in target mode by sending MI-flagged DEP_REQ fragments
followed by an ACK with matching PNI, or in initiator mode via the
symmetric chaining ACK path. Normal DEP frames use digital_skb_alloc()
which gets headroom from ddev->tx_headroom, so the bug only manifests
through the chaining_skb path.
The skb_copy_expand() reallocation in the same function preserves the
original 1-byte headroom and does not add tailroom for the CRC or DID
byte appended by the send path.
Switch to digital_skb_alloc() which reserves the same headroom and
tailroom that every other send buffer in this file uses, and pass
ddev->tx_headroom and ddev->tx_tailroom to skb_copy_expand().
Fixes: c12715ab3f01 ("NFC: digital: Add NFC-DEP Receive Chaining Support")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
net/nfc/digital_dep.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084..6d8e662a3 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -240,8 +240,8 @@ digital_recv_dep_data_gather(struct nfc_digital_dev *ddev, u8 pfb,
if (DIGITAL_NFC_DEP_MI_BIT_SET(pfb) && (!ddev->chaining_skb)) {
ddev->chaining_skb =
- nfc_alloc_recv_skb(8 * ddev->local_payload_max,
- GFP_KERNEL);
+ digital_skb_alloc(ddev,
+ 8 * ddev->local_payload_max);
if (!ddev->chaining_skb) {
rc = -ENOMEM;
goto error;
@@ -251,9 +251,9 @@ digital_recv_dep_data_gather(struct nfc_digital_dev *ddev, u8 pfb,
if (ddev->chaining_skb) {
if (resp->len > skb_tailroom(ddev->chaining_skb)) {
new_skb = skb_copy_expand(ddev->chaining_skb,
- skb_headroom(
- ddev->chaining_skb),
- 8 * ddev->local_payload_max,
+ ddev->tx_headroom,
+ 8 * ddev->local_payload_max +
+ ddev->tx_tailroom,
GFP_KERNEL);
if (!new_skb) {
rc = -ENOMEM;
--
2.50.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH net 2/2] nfc: digital: check resp length in digital_tg_send_atr_res_complete()
2026-09-12 13:18 [PATCH net 0/2] nfc: digital: fix two bugs in NFC-DEP chaining and frame handling Liu Chao
2026-09-12 13:18 ` [PATCH net 1/2] nfc: digital: reserve proper headroom for chaining_skb Liu Chao
@ 2026-09-12 13:18 ` Liu Chao
1 sibling, 0 replies; 3+ messages in thread
From: Liu Chao @ 2026-09-12 13:18 UTC (permalink / raw)
To: David Heidelberg
Cc: Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
David S . Miller, oe-linux-nfc, netdev, linux-kernel, Liu Chao,
stable
digital_tg_send_atr_res_complete() reads resp->data[0] and
resp->data[offset] (offset 2 or 3) without checking resp->len.
The resp skb comes from the remote NFC peer, which controls its
length. A short frame causes reads past the end of the received
data.
The downstream handlers (digital_tg_recv_psl_req, digital_tg_recv_dep_req)
each have their own length checks, so the consequence is a misdirected
dispatch on stale data rather than memory corruption. Add the missing
check as hardening.
Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
net/nfc/digital_dep.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 6d8e662a3..5093b7b81 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1467,16 +1467,19 @@ static void digital_tg_recv_psl_req(struct nfc_digital_dev *ddev, void *arg,
static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,
void *arg, struct sk_buff *resp)
{
- int offset;
+ unsigned int offset;
if (IS_ERR(resp)) {
digital_poll_next_tech(ddev);
return;
}
- offset = 2;
- if (resp->data[0] == DIGITAL_NFC_DEP_NFCA_SOD_SB)
- offset++;
+ if (!resp->len)
+ goto bad_frame;
+
+ offset = (resp->data[0] == DIGITAL_NFC_DEP_NFCA_SOD_SB) ? 3 : 2;
+ if (resp->len <= offset)
+ goto bad_frame;
ddev->atn_count = 0;
@@ -1484,6 +1487,12 @@ static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,
digital_tg_recv_psl_req(ddev, arg, resp);
else
digital_tg_recv_dep_req(ddev, arg, resp);
+
+ return;
+
+bad_frame:
+ kfree_skb(resp);
+ digital_poll_next_tech(ddev);
}
static int digital_tg_send_atr_res(struct nfc_digital_dev *ddev,
--
2.50.1
^ permalink raw reply related [flat|nested] 3+ messages in thread