[PATCH net] nfc: nci: fix out-of-bounds read in activation parameter parsing
From: Muhammad Bilal <hidden>
Date: 2026-06-28 21:00:36
Also in:
lkml, oe-linux-nfc
Subsystem:
networking [general], nfc subsystem, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Heidelberg, Linus Torvalds
nci_extract_activation_params_iso_dep() and
nci_extract_activation_params_nfc_dep() receive a pointer into the
RF_INTF_ACTIVATED_NTF notification but are not told how many bytes
remain. Each reads a one-byte length field (rats_res_len,
attrib_res_len, atr_res_len or atr_req_len) and then memcpy()s that many
bytes from the packet. The length is clamped to the destination size,
but it is never checked against the remaining activation-parameter data,
so a notification whose length field is larger than the data present
reads past the end of the buffer.
The sibling nci_extract_rf_params_*() helpers were recently given a
data_len argument and matching remaining-length checks, but the
activation-parameter helpers were not updated.
Pass the remaining length down and validate each field against it before
copying, as the rf_params helpers do.
Fixes: ac2068384034 ("NFC: Parse NCI NFC-DEP activation params")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <redacted>
---
net/nfc/nci/ntf.c | 36 ++++++++++++++++++++++++++++++------
1 file changed, 30 insertions(+), 6 deletions(-)
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index c96512bb86531..63aa0a78472b1 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c@@ -525,7 +525,7 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev, static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, struct nci_rf_intf_activated_ntf *ntf, - const __u8 *data) + const __u8 *data, ssize_t data_len) { struct activation_params_nfca_poll_iso_dep *nfca_poll; struct activation_params_nfcb_poll_iso_dep *nfcb_poll;
@@ -533,9 +533,14 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, switch (ntf->activation_rf_tech_and_mode) { case NCI_NFC_A_PASSIVE_POLL_MODE: nfca_poll = &ntf->activation_params.nfca_poll_iso_dep; + if (data_len < 1) + return NCI_STATUS_RF_PROTOCOL_ERROR; nfca_poll->rats_res_len = min_t(__u8, *data++, NFC_ATS_MAXSIZE); + data_len--; pr_debug("rats_res_len %d\n", nfca_poll->rats_res_len); if (nfca_poll->rats_res_len > 0) { + if (data_len < nfca_poll->rats_res_len) + return NCI_STATUS_RF_PROTOCOL_ERROR; memcpy(nfca_poll->rats_res, data, nfca_poll->rats_res_len); }
@@ -543,9 +548,14 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, case NCI_NFC_B_PASSIVE_POLL_MODE: nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep; + if (data_len < 1) + return NCI_STATUS_RF_PROTOCOL_ERROR; nfcb_poll->attrib_res_len = min_t(__u8, *data++, 50); + data_len--; pr_debug("attrib_res_len %d\n", nfcb_poll->attrib_res_len); if (nfcb_poll->attrib_res_len > 0) { + if (data_len < nfcb_poll->attrib_res_len) + return NCI_STATUS_RF_PROTOCOL_ERROR; memcpy(nfcb_poll->attrib_res, data, nfcb_poll->attrib_res_len); }
@@ -562,7 +572,7 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev, static int nci_extract_activation_params_nfc_dep(struct nci_dev *ndev, struct nci_rf_intf_activated_ntf *ntf, - const __u8 *data) + const __u8 *data, ssize_t data_len) { struct activation_params_poll_nfc_dep *poll; struct activation_params_listen_nfc_dep *listen;
@@ -571,21 +581,33 @@ static int nci_extract_activation_params_nfc_dep(struct nci_dev *ndev, case NCI_NFC_A_PASSIVE_POLL_MODE: case NCI_NFC_F_PASSIVE_POLL_MODE: poll = &ntf->activation_params.poll_nfc_dep; + if (data_len < 1) + return NCI_STATUS_RF_PROTOCOL_ERROR; poll->atr_res_len = min_t(__u8, *data++, NFC_ATR_RES_MAXSIZE - 2); + data_len--; pr_debug("atr_res_len %d\n", poll->atr_res_len); - if (poll->atr_res_len > 0) + if (poll->atr_res_len > 0) { + if (data_len < poll->atr_res_len) + return NCI_STATUS_RF_PROTOCOL_ERROR; memcpy(poll->atr_res, data, poll->atr_res_len); + } break; case NCI_NFC_A_PASSIVE_LISTEN_MODE: case NCI_NFC_F_PASSIVE_LISTEN_MODE: listen = &ntf->activation_params.listen_nfc_dep; + if (data_len < 1) + return NCI_STATUS_RF_PROTOCOL_ERROR; listen->atr_req_len = min_t(__u8, *data++, NFC_ATR_REQ_MAXSIZE - 2); + data_len--; pr_debug("atr_req_len %d\n", listen->atr_req_len); - if (listen->atr_req_len > 0) + if (listen->atr_req_len > 0) { + if (data_len < listen->atr_req_len) + return NCI_STATUS_RF_PROTOCOL_ERROR; memcpy(listen->atr_req, data, listen->atr_req_len); + } break; default:
@@ -806,12 +828,14 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev, switch (ntf.rf_interface) { case NCI_RF_INTERFACE_ISO_DEP: err = nci_extract_activation_params_iso_dep(ndev, - &ntf, data); + &ntf, data, + ntf.activation_params_len); break; case NCI_RF_INTERFACE_NFC_DEP: err = nci_extract_activation_params_nfc_dep(ndev, - &ntf, data); + &ntf, data, + ntf.activation_params_len); break; case NCI_RF_INTERFACE_FRAME:
--
2.54.0