github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 11:06:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfc: st21nfca: validate received frame size

Browse Source 
st21nfca_hci_i2c_repack() trims a received frame at its EOF marker
before removing byte stuffing.  It then assumes the truncated frame
contains the LLC header and two CRC bytes, and it unconditionally reads
the byte after an escape marker.

A malformed frame can place EOF immediately after the start marker or can
end its data portion with an escape marker.  The former leaves too few
bytes for check_crc(), while the latter makes the unstuffing loop read past
the current skb length.

Require the minimum framing bytes both before and after unstuffing.  Use
separate input and output cursors while removing byte stuffing, and reject
an escape marker without its encoded byte.  This keeps malformed frames
within the received frame boundary before CRC processing.

Fixes: 3096e25a3e ("NFC: st21nfca: Fix incorrect byte stuffing revocation")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084405.41546-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Pengpeng Hou 2026-07-15 16:44:05 +08:00 committed by David Heidelberg
parent 686f942332
commit a653c01ce4
No known key found for this signature in database
GPG Key ID: 60023FC4D3492072
1 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
drivers/nfc/st21nfca/i2c.c
View File

@ -289,27 +289,36 @@ static int check_crc(u8 *buf, int buflen)
*/
static int st21nfca_hci_i2c_repack(struct sk_buff *skb)
{
int i, j, r, size;
int read, write, r, size;
if (skb->len < 1 || (skb->len > 1 && skb->data[1] != 0))
if (skb->len < ST21NFCA_FRAME_HEADROOM ||
!IS_START_OF_FRAME(skb->data))
return -EBADMSG;
size = get_frame_size(skb->data, skb->len);
if (size > 0) {
if (size < ST21NFCA_FRAME_HEADROOM + 2)
return -EBADMSG;
skb_trim(skb, size);
/* remove ST21NFCA byte stuffing for upper layer */
for (i = 1, j = 0; i < skb->len; i++) {
if (skb->data[i + j] ==
for (read = 1, write = 1; read < skb->len;) {
if (skb->data[read] ==
(u8) ST21NFCA_ESCAPE_BYTE_STUFFING) {
skb->data[i] = skb->data[i + j + 1]
| ST21NFCA_BYTE_STUFFING_MASK;
i++;
j++;
if (read + 1 == skb->len)
return -EBADMSG;
skb->data[write++] = skb->data[read + 1]
| ST21NFCA_BYTE_STUFFING_MASK;
read += 2;
} else {
skb->data[write++] = skb->data[read++];
}
skb->data[i] = skb->data[i + j];
}
/* remove byte stuffing useless byte */
skb_trim(skb, i - j);
skb_trim(skb, write);
if (skb->len < ST21NFCA_FRAME_HEADROOM + 2)
return -EBADMSG;
/* remove ST21NFCA_SOF_EOF from head */
skb_pull(skb, 1);