github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfc: fdp: bound the device-reported read length and fix an skb leak

Browse Source 
fdp_nci_i2c_read() takes the next packet length from two device-supplied
bytes and never validates it. The value is a u16 used as the
i2c_master_recv() count into a 261-byte on-stack buffer: a malicious,
counterfeit or malfunctioning controller (or an i2c bus interposer) can
drive it far past the buffer for a stack out-of-bounds write that
clobbers the canary and return address, or below the minimum frame size
(directly, or by truncating the computed sum) so the header/LRC strip
and the next length read run past a short receive. Reject a length
outside [FDP_NCI_I2C_MIN_PAYLOAD, FDP_NCI_I2C_MAX_PAYLOAD], as a
corrupted packet already is, and force resynchronization.

The same loop allocates one data skb per iteration and assumes a length
packet followed by a data packet; a device that sends two data packets
in one call leaks the first skb when the second allocation overwrites
it. Free a previously allocated skb before allocating the next.

Fixes: a06347c04c ("NFC: Add Intel Fields Peak NFC solution driver")
Cc: stable@vger.kernel.org
Suggested-by: Simon Horman <horms@kernel.org>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260616-b4-disp-b1f8ab4c-v2-1-2d1fe5955325@proton.me
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Bryam Vargas 2026-06-16 23:33:35 -05:00 committed by David Heidelberg
parent ac200079db
commit 7ad21dcfeb
No known key found for this signature in database
GPG Key ID: 60023FC4D3492072
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
drivers/nfc/fdp/i2c.c
View File

@ -166,9 +166,36 @@ static int fdp_nci_i2c_read(struct fdp_i2c_phy *phy, struct sk_buff **skb)
/* Packet that contains a length */
if (tmp[0] == 0 && tmp[1] == 0) {
phy->next_read_size = (tmp[2] << 8) + tmp[3] + 3;
/*
* next_read_size is taken from the device and is used
* as the i2c_master_recv() count for the next packet
* and as the data skb size. A value above the receive
* buffer overflows tmp[]; one below the minimum frame
* size runs the header/LRC strip and the length-field
* read past a short receive. Either way the packet is
* corrupt: drop it and force resynchronization.
*/
if (phy->next_read_size < FDP_NCI_I2C_MIN_PAYLOAD ||
phy->next_read_size > FDP_NCI_I2C_MAX_PAYLOAD) {
dev_dbg(&client->dev, "%s: corrupted packet\n",
__func__);
phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
goto flush;
}
} else {
phy->next_read_size = FDP_NCI_I2C_MIN_PAYLOAD;
/*
* Only one data packet is delivered per call; if the
* device sends another, do not overwrite and leak the
* skb allocated for the previous one.
*/
if (*skb) {
kfree_skb(*skb);
*skb = NULL;
}
*skb = alloc_skb(len, GFP_KERNEL);
if (*skb == NULL) {
r = -ENOMEM;