[PATCH] nfc: llcp: validate PDU size in nfc_llcp_recv_dm() and nfc_llcp_recv_hdlc()

[Aamir Ahmed <elb12345@hotmail.co.uk>]

nfc_llcp_recv_dm() reads the reason byte at skb->data[2], and
nfc_llcp_recv_hdlc() reads the sequence byte at the same offset
through nfc_llcp_ns() and nfc_llcp_nr().  Both run after
__nfc_llcp_recv(), which only guarantees LLCP_HEADER_SIZE (2) bytes
via pskb_may_pull().

A malformed PDU that is exactly two bytes long -- delivered directly by
the NFC controller, or as an aggregated PDU inside an AGF frame whose
inner length field is 2 -- causes both handlers to read one byte past
the guaranteed data.  In the direct case the byte is whatever follows
the valid payload in the skb buffer.  In the AGF case the inner skb is
allocated by nfc_alloc_recv_skb() with exactly two bytes of payload, so
the read is past the meaningful data and into whatever the slab
allocator left there.

For DM, the stale reason byte selects between NOBOUND/REJ and the
default socket-lookup path, potentially closing the wrong socket.  For
HDLC, the stale sequence byte corrupts N(S)/N(R) tracking: a bogus
N(R) drains the tx_pending_queue unconditionally, dropping in-flight I
frames and breaking the connection.

Add a minimum-length check to each handler: DM requires
LLCP_HEADER_SIZE + 1 (the reason byte) and HDLC requires
LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE.

Fixes: d646960f7986 ("NFC: Initial LLCP support")
Cc: stable@vger.kernel.org
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
---
 net/nfc/llcp_core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index cac1b5487064..89d6f4599e11 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1077,6 +1077,12 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
 	ptype = nfc_llcp_ptype(skb);
 	dsap = nfc_llcp_dsap(skb);
 	ssap = nfc_llcp_ssap(skb);
+
+	if (skb->len < LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE) {
+		nfc_llcp_send_dm(local, dsap, ssap, LLCP_DM_NOCONN);
+		return;
+	}
+
 	ns = nfc_llcp_ns(skb);
 	nr = nfc_llcp_nr(skb);
 
@@ -1254,6 +1260,10 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
 
 	dsap = nfc_llcp_dsap(skb);
 	ssap = nfc_llcp_ssap(skb);
+
+	if (skb->len < LLCP_HEADER_SIZE + 1)
+		return;
+
 	reason = skb->data[2];
 
 	pr_debug("%d %d reason %d\n", ssap, dsap, reason);
-- 
2.43.0