From: Linkui Xiao <redacted>
nfc_llcp_allocate_snl() sums the requested TLV payload length into a u16
variable before passing it to alloc_skb(), but its tlv_length argument
is a size_t and callers pass a length bounded only by the size of the
netlink message that produced it.
nfc_genl_llc_sdreq() walks the nested NFC_ATTR_LLC_SDP attributes of a
GENL_ADMIN_PERM request, builds one SDREQ TLV per attribute and sums
their lengths into the size_t tlvs_len. Each URI is capped at
U8_MAX - 4 bytes by nfc_sdp_genl_policy, so every TLV fits in its u8
tlv_len, but nothing caps the number of attributes, so tlvs_len can
exceed U16_MAX.
When it does, the u16 accumulator wraps and alloc_skb() returns a
buffer that is far too small. nfc_llcp_send_snl_sdreq() then calls
skb_put_data() once per TLV and writes all tlvs_len bytes into it,
which trips skb_over_panic() and panics the machine.
Use size_t for the accumulated size so that it can no longer wrap
before the allocation. alloc_skb() takes an unsigned int, which is
still wide enough for any length a netlink message can carry.
Fixes: e0ae7bac06cc ("NFC: llcp: Service Name Lookup SDRES aggregation")
Reported-by: Guikun Yang <redacted>
Link: https://lore.kernel.org/netdev/tencent_634C55A23C7CCCA3985283BFED46A69C9E09@qq.com/ (local)
Cc: <redacted>
Signed-off-by: Linkui Xiao <redacted>
---
net/nfc/llcp_commands.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 80a00938c869..0a3d66e6cd59 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -542,7 +542,7 @@ static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
{
struct sk_buff *skb;
struct nfc_dev *dev;
- u16 size = 0;
+ size_t size = 0;
if (local == NULL)
return ERR_PTR(-ENODEV);--
2.25.1