[PATCH v2] net: nfc: nc: Add parameter validation for packet data
From: Deepak Sharma <hidden>
Date: 2025-09-17 14:07:51
Also in:
linux-kernel-mentees
Subsystem:
networking [general], nfc subsystem, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Heidelberg, Linus Torvalds
This is v2 for the original patch, I realized soon after sending the patch that I missed the release of skb before returning, apologies. Syzbot reported an uninit-value bug at nci_init_req for commit 5aca7966d2a7 This bug arises due to very limited and poor input validation that was done at net/nfc/nci/core.c:1543. This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet Following the same silent drop of packets of invalid sizes, at net/nfc/nci/core.c:1543, I have added validation in the `nci_nft_packet` which processes NFT packets and silently return in case of failure of any validation check Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers) Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8 Signed-off-by: Deepak Sharma <redacted> --- net/nfc/nci/ntf.c | 42 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 34 insertions(+), 8 deletions(-)
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index a818eff27e6b..f5e03f3ff203 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c@@ -809,35 +809,61 @@ void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb) switch (ntf_opcode) { case NCI_OP_CORE_RESET_NTF: - nci_core_reset_ntf_packet(ndev, skb); + if (skb->len < sizeof(struct nci_core_reset_ntf)) + goto end; + else + nci_core_reset_ntf_packet(ndev, skb); break; case NCI_OP_CORE_CONN_CREDITS_NTF: - nci_core_conn_credits_ntf_packet(ndev, skb); + if (skb->len < sizeof(struct nci_core_conn_credit_ntf)) + goto end; + else + nci_core_conn_credits_ntf_packet(ndev, skb); break; case NCI_OP_CORE_GENERIC_ERROR_NTF: - nci_core_generic_error_ntf_packet(ndev, skb); + if (skb->len < 1) + goto end; + else + nci_core_generic_error_ntf_packet(ndev, skb); break; case NCI_OP_CORE_INTF_ERROR_NTF: - nci_core_conn_intf_error_ntf_packet(ndev, skb); + if (skb->len < sizeof(struct nci_core_intf_error_ntf)) + goto end; + else + nci_core_conn_intf_error_ntf_packet(ndev, skb); break; case NCI_OP_RF_DISCOVER_NTF: - nci_rf_discover_ntf_packet(ndev, skb); + // tech specific params are included as unions + if (skb->len < sizeof(struct nci_rf_discover_ntf)) + goto end; + else + nci_rf_discover_ntf_packet(ndev, skb); break; case NCI_OP_RF_INTF_ACTIVATED_NTF: - nci_rf_intf_activated_ntf_packet(ndev, skb); + // tech specific params are included as unions + if (skb->len < sizeof(struct nci_rf_intf_activated_ntf)) + goto end; + else + nci_rf_intf_activated_ntf_packet(ndev, skb); break; case NCI_OP_RF_DEACTIVATE_NTF: - nci_rf_deactivate_ntf_packet(ndev, skb); + if (skb->len < sizeof(struct nci_rf_deactivate_ntf)) + goto end; + else + nci_rf_deactivate_ntf_packet(ndev, skb); break; case NCI_OP_NFCEE_DISCOVER_NTF: - nci_nfcee_discover_ntf_packet(ndev, skb); + if (skb->len < sizeof(struct nci_nfcee_discover_ntf)) + goto end; + else + nci_nfcee_discover_ntf_packet(ndev, skb); break; case NCI_OP_RF_NFCEE_ACTION_NTF:
--
2.51.0