Hello,
__nfc_llcp_recv() only pulls the two-byte LLCP header before
dispatching, but nfc_llcp_recv_dm() reads skb->data[2] for the DM
reason code. A two-byte DM PDU (or the AGF-wrapped equivalent) from a
remote peer therefore reads one byte past skb->len. The HDLC handler
pulls its extra byte; the DM handler does not.
With current drivers the read stays inside the over-allocated skb, so
this is a KMSAN-visible uninitialized read rather than a slab overread,
and the value only steers the reason-code switch. The patch pulls the
extra byte first.
Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/nfc/llcp_core.c:1278-1290 (nfc_llcp_recv_dm), llcp_core.c:1620-1633 (caller's pull).
Longstanding code.
This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.
Reported-by: Noah Weinberger <redacted>
---
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 74bf817..733e643 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1276,13 +1276,16 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
}
static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
- const struct sk_buff *skb)
+ struct sk_buff *skb)
{
struct nfc_llcp_sock *llcp_sock;
struct sock *sk;
u8 dsap, ssap, reason;
bool connecting = false;
+ if (!pskb_may_pull(skb, LLCP_HEADER_SIZE + 1))
+ return;
+
dsap = nfc_llcp_dsap(skb);
ssap = nfc_llcp_ssap(skb);
reason = skb->data[2];