[PATCH] nfc: nci: validate CORE_CONN_CREATE response length before reading fields

[PATCH] nfc: nci: validate CORE_CONN_CREATE response length before reading fields

[Aamir Ahmed]

nci_core_conn_create_rsp_packet() casts skb->data to struct
nci_core_conn_create_rsp and accesses its conn_id,
max_ctrl_pkt_payload_len, and credits_cnt fields (offsets 1-3) when
the status byte is NCI_STATUS_OK.  However, the NCI transport layer
(nci_valid_size) only guarantees that the payload contains at least
one byte.  A malformed response with plen=1 and status=0 passes this
check, and the handler then reads three bytes past the valid payload,
using uninitialised slab data to populate the connection info that is
later used for NFC data exchange.

This can be triggered from userspace via the virtual_ncidev interface
by injecting a short CORE_CONN_CREATE_RSP frame.

Add a length check for the full response structure before accessing
any field beyond the status byte.

Fixes: 736bb9577407 ("NFC: nci: Support logical connections management")
Cc: stable@vger.kernel.org
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
---
 net/nfc/nci/rsp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index b0ab4f5acbce..72b748f0be9f 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -312,6 +312,10 @@ static void nci_core_conn_create_rsp_packet(struct nci_dev *ndev,
 	pr_debug("status 0x%x\n", status);
 
 	if (status == NCI_STATUS_OK) {
+		if (skb->len < sizeof(*rsp)) {
+			status = NCI_STATUS_SYNTAX_ERROR;
+			goto exit;
+		}
 		rsp = (struct nci_core_conn_create_rsp *)skb->data;
 
 		conn_info = devm_kzalloc(&ndev->nfc_dev->dev,
-- 
2.43.0

Re: [PATCH] nfc: nci: validate CORE_CONN_CREATE response length before reading fields

[Simon Horman]

On Mon, Sep 07, 2026 at 06:28:55AM +0000, Aamir Ahmed wrote:
> nci_core_conn_create_rsp_packet() casts skb->data to struct
> nci_core_conn_create_rsp and accesses its conn_id,
> max_ctrl_pkt_payload_len, and credits_cnt fields (offsets 1-3) when
> the status byte is NCI_STATUS_OK.  However, the NCI transport layer
> (nci_valid_size) only guarantees that the payload contains at least
> one byte.  A malformed response with plen=1 and status=0 passes this
> check, and the handler then reads three bytes past the valid payload,
> using uninitialised slab data to populate the connection info that is
> later used for NFC data exchange.
> 
> This can be triggered from userspace via the virtual_ncidev interface
> by injecting a short CORE_CONN_CREATE_RSP frame.
> 
> Add a length check for the full response structure before accessing
> any field beyond the status byte.
> 
> Fixes: 736bb9577407 ("NFC: nci: Support logical connections management")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>

This patch looks good to me but as noted collectively by Greg and Paolo
elsewhere:
1. Please include an Assisted-by tag
2. Please keep the number of patches in-flight to 15 or less

When you repost feel free to include:

Reviewed-by: Simon Horman <horms@kernel.org>

-- 
pw-bot: changes-requested