[PATCH net] nfc: nci: fix out-of-bounds read in nci_core_reset_rsp_packet()
WARM1d
From: Ömer Mete Kaya <hidden>
Date: 2026-09-30 22:49:59
Also in:
lkml, oe-linux-nfc
Subsystem:
networking [general], nfc subsystem, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Heidelberg, Linus Torvalds
nci_core_reset_rsp_packet() guards with skb->len != 1 before reading
rsp->nci_ver (offset 1) and rsp->config_status (offset 2), but this
admits a 2-byte payload where config_status lies one byte past skb->len.
Fix by replacing the != 1 guard with an explicit >= 3 check before
accessing those fields. The 1-byte (NCI 1.x status-only) case is
handled first with an early return so nci_req_complete() is always
called regardless of payload length. nci_valid_size() in the caller
guarantees skb->len >= 1, so a zero-length payload never reaches this
handler.
Fixes: bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence")
Signed-off-by: Ömer Mete Kaya <redacted>
---
net/nfc/nci/rsp.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index b0ab4f5ac..e52956bf3 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c@@ -32,16 +32,22 @@ static void nci_core_reset_rsp_packet(struct nci_dev *ndev, pr_debug("status 0x%x\n", rsp->status); - /* Handle NCI 1.x ver */ - if (skb->len != 1) { - if (rsp->status == NCI_STATUS_OK) { - ndev->nci_ver = rsp->nci_ver; - pr_debug("nci_ver 0x%x, config_status 0x%x\n", - rsp->nci_ver, rsp->config_status); - } - + /* NCI 2.x reset response carries nci_ver and config_status; + * a 1-byte response is the NCI 1.x status-only form. + * Require at least 3 bytes before reading those fields. + */ + if (skb->len == 1) { nci_req_complete(ndev, rsp->status); + return; } + + if (skb->len >= 3 && rsp->status == NCI_STATUS_OK) { + ndev->nci_ver = rsp->nci_ver; + pr_debug("nci_ver 0x%x, config_status 0x%x\n", + rsp->nci_ver, rsp->config_status); + } + + nci_req_complete(ndev, rsp->status); } static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev, --
2.55.0