[PATCH net] nfc: hci: add bounds checking in nfc_hci_create_pipe()

The "pipe" value comes from the controller ADM_CREATE_PIPE response
and can be anything in the 0-255 range, while hdev->pipes[] only has
NFC_HCI_MAX_PIPES (128) entries.  A response carrying a pipe id above
127 makes the caller, nfc_hci_connect_gate(), write past the end of
hdev->pipes[].

The response length is also not validated before the cast to struct
hci_create_pipe_resp, so a short response leads to reading past the
end of the received data.

The notification path in nfc_hci_cmd_received() already validates both
the length and the pipe id for the very same structure; do the same
for the command response path.  Set *result so that the caller does
not mistake a rejected pipe for success, which is why this differs
slightly from the NCI side fix, commit 110b43ef0534 ("NFC: nci: Add
bounds checking in nci_hci_create_pipe()").

Fixes: 118278f20aa8 ("NFC: hci: Add pipes table to reference them with a tuple {gate, host}")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <redacted>
---
 net/nfc/hci/command.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
index af6bacb3b..9c8bcb98b 100644
--- a/net/nfc/hci/command.c
+++ b/net/nfc/hci/command.c

@@ -225,10 +225,19 @@ static u8 nfc_hci_create_pipe(struct nfc_hci_dev *hdev, u8 dest_host,
 	if (*result < 0)
 		return NFC_HCI_INVALID_PIPE;
 
+	if (skb->len < sizeof(*resp)) {
+		kfree_skb(skb);
+		*result = -EPROTO;
+		return NFC_HCI_INVALID_PIPE;
+	}
 	resp = (struct hci_create_pipe_resp *)skb->data;
 	pipe = resp->pipe;
 	kfree_skb(skb);
 
+	if (pipe >= NFC_HCI_MAX_PIPES) {
+		*result = -EINVAL;
+		return NFC_HCI_INVALID_PIPE;
+	}
 	pr_debug("pipe created=%d\n", pipe);
 
 	return pipe;

base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
-- 
2.50.1