[PATCH net 0/2] nfc: digital: fix two bugs in NFC-DEP chaining and frame handling

[PATCH net 0/2] nfc: digital: fix two bugs in NFC-DEP chaining and frame handling

[Liu Chao]

Patch 1 fixes a guaranteed kernel panic (skb_under_panic) caused by
pushing protocol headers into a chaining_skb allocated with only
1 byte of headroom.  Both initiator and target paths are affected.
Switch to digital_skb_alloc() which reserves the same head and
tailroom used by every other send buffer in this file.

Patch 2 adds a length check in the ATR_RES completion callback
as hardening; the downstream handlers already validate, so the
practical impact is limited to misdirected dispatch on stale data.

Liu Chao (2):
  nfc: digital: reserve proper headroom for chaining_skb
  nfc: digital: check resp length in digital_tg_send_atr_res_complete()

 net/nfc/digital_dep.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)


base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
-- 
2.50.1

[PATCH net 1/2] nfc: digital: reserve proper headroom for chaining_skb

[Liu Chao]

digital_recv_dep_data_gather() allocates chaining_skb with
nfc_alloc_recv_skb(), which only reserves 1 byte of headroom.
Once the chained payload is fully gathered, it is passed to
digital_tg_send_dep_res() or digital_in_send_dep_req(), both of
which push a 3-byte DEP header plus up to 2 bytes of SoD, needing
at least 5 bytes of headroom.

skb_push() unconditionally calls skb_under_panic() when headroom is
insufficient, so this is a guaranteed kernel BUG.  A remote NFC peer
can trigger it in target mode by sending MI-flagged DEP_REQ fragments
followed by an ACK with matching PNI, or in initiator mode via the
symmetric chaining ACK path.  Normal DEP frames use digital_skb_alloc()
which gets headroom from ddev->tx_headroom, so the bug only manifests
through the chaining_skb path.

The skb_copy_expand() reallocation in the same function preserves the
original 1-byte headroom and does not add tailroom for the CRC or DID
byte appended by the send path.

Switch to digital_skb_alloc() which reserves the same headroom and
tailroom that every other send buffer in this file uses, and pass
ddev->tx_headroom and ddev->tx_tailroom to skb_copy_expand().

Fixes: c12715ab3f01 ("NFC: digital: Add NFC-DEP Receive Chaining Support")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 net/nfc/digital_dep.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084..6d8e662a3 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -240,8 +240,8 @@ digital_recv_dep_data_gather(struct nfc_digital_dev *ddev, u8 pfb,
 
 	if (DIGITAL_NFC_DEP_MI_BIT_SET(pfb) && (!ddev->chaining_skb)) {
 		ddev->chaining_skb =
-			nfc_alloc_recv_skb(8 * ddev->local_payload_max,
-					   GFP_KERNEL);
+			digital_skb_alloc(ddev,
+					  8 * ddev->local_payload_max);
 		if (!ddev->chaining_skb) {
 			rc = -ENOMEM;
 			goto error;
@@ -251,9 +251,9 @@ digital_recv_dep_data_gather(struct nfc_digital_dev *ddev, u8 pfb,
 	if (ddev->chaining_skb) {
 		if (resp->len > skb_tailroom(ddev->chaining_skb)) {
 			new_skb = skb_copy_expand(ddev->chaining_skb,
-						  skb_headroom(
-							  ddev->chaining_skb),
-						  8 * ddev->local_payload_max,
+						  ddev->tx_headroom,
+						  8 * ddev->local_payload_max +
+							  ddev->tx_tailroom,
 						  GFP_KERNEL);
 			if (!new_skb) {
 				rc = -ENOMEM;
-- 
2.50.1

[PATCH net 2/2] nfc: digital: check resp length in digital_tg_send_atr_res_complete()

[Liu Chao]

digital_tg_send_atr_res_complete() reads resp->data[0] and
resp->data[offset] (offset 2 or 3) without checking resp->len.
The resp skb comes from the remote NFC peer, which controls its
length.  A short frame causes reads past the end of the received
data.

The downstream handlers (digital_tg_recv_psl_req, digital_tg_recv_dep_req)
each have their own length checks, so the consequence is a misdirected
dispatch on stale data rather than memory corruption.  Add the missing
check as hardening.

Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 net/nfc/digital_dep.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 6d8e662a3..5093b7b81 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1467,16 +1467,19 @@ static void digital_tg_recv_psl_req(struct nfc_digital_dev *ddev, void *arg,
 static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,
 					     void *arg, struct sk_buff *resp)
 {
-	int offset;
+	unsigned int offset;
 
 	if (IS_ERR(resp)) {
 		digital_poll_next_tech(ddev);
 		return;
 	}
 
-	offset = 2;
-	if (resp->data[0] == DIGITAL_NFC_DEP_NFCA_SOD_SB)
-		offset++;
+	if (!resp->len)
+		goto bad_frame;
+
+	offset = (resp->data[0] == DIGITAL_NFC_DEP_NFCA_SOD_SB) ? 3 : 2;
+	if (resp->len <= offset)
+		goto bad_frame;
 
 	ddev->atn_count = 0;
 
@@ -1484,6 +1487,12 @@ static void digital_tg_send_atr_res_complete(struct nfc_digital_dev *ddev,
 		digital_tg_recv_psl_req(ddev, arg, resp);
 	else
 		digital_tg_recv_dep_req(ddev, arg, resp);
+
+	return;
+
+bad_frame:
+	kfree_skb(resp);
+	digital_poll_next_tech(ddev);
 }
 
 static int digital_tg_send_atr_res(struct nfc_digital_dev *ddev,
-- 
2.50.1