github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

Browse Source 
nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse
the CORE_INIT_RSP packet without validating that the skb contains
enough data. A malformed response (e.g. injected via virtual_ncidev)
can declare a large num_supported_rf_interfaces while providing
insufficient data, causing reads of uninitialized slab memory. This
is later used in nci_init_complete_req(), triggering a KMSAN
uninit-value warning.

Add skb length checks before accessing packet fields:
- Validate the skb has at least 1 byte for the status field.
- Validate the skb can hold the fixed-size header before parsing.
- In v2, bounds-check each variable-length rf_interface entry and its
  extension parameters within the parsing loop.
- In v1, verify the skb is large enough for both the variable-length
  rf_interfaces array and the trailing rsp_2 structure.

Reported-by: syzbot+46ca2592193f2fb3debc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=46ca2592193f2fb3debc
Fixes: bcd684aace ("net/nfc/nci: Support NCI 2.x initial sequence")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260527052625.3309581-1-yun.zhou@windriver.com
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Yun Zhou 2026-05-27 13:26:25 +08:00 committed by David Heidelberg
parent 5718fc6219
commit d56575a259
No known key found for this signature in database
GPG Key ID: 60023FC4D3492072
1 changed files with 38 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
net/nfc/nci/rsp.c
View File

@ -50,11 +50,27 @@ static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev,
const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
const struct nci_core_init_rsp_2 *rsp_2;
/* Ensure that the status field can be accessed. */
if (skb_headlen(skb) < 1)
return NCI_STATUS_SYNTAX_ERROR;
pr_debug("status 0x%x\n", rsp_1->status);
if (rsp_1->status != NCI_STATUS_OK)
return rsp_1->status;
/* Success response must contain the full fixed-size header */
if (skb_headlen(skb) < sizeof(*rsp_1))
return NCI_STATUS_SYNTAX_ERROR;
/* Ensure the variable-length rf_interfaces array and trailing
* rsp_2 structure are fully contained within the skb.
*/
if (skb_headlen(skb) < sizeof(*rsp_1) +
rsp_1->num_supported_rf_interfaces +
sizeof(*rsp_2))
return NCI_STATUS_SYNTAX_ERROR;
ndev->nfcc_features = __le32_to_cpu(rsp_1->nfcc_features);
ndev->num_supported_rf_interfaces = rsp_1->num_supported_rf_interfaces;
@ -87,15 +103,25 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev,
const struct sk_buff *skb)
{
const struct nci_core_init_rsp_nci_ver2 *rsp = (void *)skb->data;
const u8 *supported_rf_interface = rsp->supported_rf_interfaces;
const u8 *supported_rf_interface;
u8 rf_interface_idx = 0;
u8 rf_extension_cnt = 0;
/* Ensure that the status field can be accessed. */
if (skb_headlen(skb) < 1)
return NCI_STATUS_SYNTAX_ERROR;
pr_debug("status %x\n", rsp->status);
if (rsp->status != NCI_STATUS_OK)
return rsp->status;
/* Success response must contain the full fixed-size header */
if (skb_headlen(skb) < sizeof(*rsp))
return NCI_STATUS_SYNTAX_ERROR;
supported_rf_interface = rsp->supported_rf_interfaces;
ndev->nfcc_features = __le32_to_cpu(rsp->nfcc_features);
ndev->num_supported_rf_interfaces = rsp->num_supported_rf_interfaces;
@ -104,13 +130,22 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev,
NCI_MAX_SUPPORTED_RF_INTERFACES);
while (rf_interface_idx < ndev->num_supported_rf_interfaces) {
ndev->supported_rf_interfaces[rf_interface_idx++] = *supported_rf_interface++;
/* Each entry: [rf_interface_type (1B)] [ext_count (1B)] [ext...] */
if (supported_rf_interface + 2 > skb_tail_pointer(skb))
break;
ndev->supported_rf_interfaces[rf_interface_idx] = *supported_rf_interface++;
/* skip rf extension parameters */
rf_extension_cnt = *supported_rf_interface++;
if (supported_rf_interface + rf_extension_cnt > skb_tail_pointer(skb))
break;
/* Only count the entry after full validation */
rf_interface_idx++;
supported_rf_interface += rf_extension_cnt;
}
ndev->num_supported_rf_interfaces = rf_interface_idx;
ndev->max_logical_connections = rsp->max_logical_connections;
ndev->max_routing_table_size =
__le16_to_cpu(rsp->max_routing_table_size);