From nobody Sat Jul 25 23:41:46 2026 Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A6592D1303 for ; Sat, 11 Jul 2026 07:27:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783754828; cv=none; b=JPCqiwM9sy88JYFys0QQmR3ShusuAzmxPKtti3WXQdlthl0nSVwu5e0jeODhsPsKdkBIaV4psDmf4Zj5ViaUVoNciUVXOpqcIAjA532XMwV8tsrAUO3F7rfH30v7igEyzXKF98dkSceyFLSaeW8VYzGlRTgJTkrPHNVeyjgilJM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783754828; c=relaxed/simple; bh=6/vKUtPPzvuNE52W1vzgh44bVwcsydD2eMshQV62Re0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ipJz4kLz3/5Xy+1bvq1c1SZlxc/1cepCuQ4ZbAQHeglU1YA6XFfZidkyjoX5Hn3vf8WSpa+Rv65u8Y8d21JJSLcxxZZfhPozAFn3Jt7aUrnlFobz1Obx5D5EOblkb8Zjp7VX1Z2xHBn5va06dmn5Yl7sYxhBuLwRTUNwq5han4E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=Mvneh4l/; arc=none smtp.client-ip=209.85.221.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="Mvneh4l/" Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-470174001a0so991312f8f.0 for ; Sat, 11 Jul 2026 00:27:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1783754825; x=1784359625; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=x1XGKV32BMtMot+0VfEXaCXl+nOm+R140hzMoZufQh0=; b=Mvneh4l/vQAqCfkG5LE3Bai326zvNRxaqYsoKy8z8BSA83+BcHn7nsjkg5Mzj2RYHr 1+PNUhj7kqASiMZ/MiUdrAlwgioze+AUpBbs7fkXW6Oa5tSbs/KeE/AzI2SFEXj7ZAkv ivbL0zK0tA6VB84CRCKzpnqpeZTnDaOWS+pFa9WMBFn5qvKngjJCR/pyKjixkhNPv6bZ XQV2ZUBKRkUKMoG/VByekyUDWbe1aiWgmOZk5vECjEBzClsb113aP7DzT8OX0bvtpIUv 0stpMkMuPfLlAzmc1JfXS74kcCZRL4WJqxDwCl7mhYXDoOj3KVmg88RkgWLGvw4XCJ3d DsjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783754825; x=1784359625; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=x1XGKV32BMtMot+0VfEXaCXl+nOm+R140hzMoZufQh0=; b=KbLAow2lNCTLh5Bk4Z2LaBAHlDokqOOqQrlPGIWv7ErpL/8RXLTqPMz/1IOqIWtGUo Yj70Ukujyy52L/jBYs9KUiJdru0m6JZ4TD1n0EwB+/BTakGOwO6MRLn1wZQ1ZyJheSBN Q5NZEwovcDEb9f3nLjLix3fB5QLkt9rWkNTSFEJ9vYDLGEs/lUQUw0q/+qMIBHKB4PwC kQxnppqXZLcOO92aWZsbYVMyDANbA4r7WUhU8mZi+YX7clzNdwANg+Qh8C57+CGLyYUj c9MBDHiH9kzbqT2pfRwjaBh/X7J/1U+kYIUTWt/i8vYJSe5yLN7+8rkav951FHnJ4IYW kHog== X-Forwarded-Encrypted: i=1; AHgh+RrFyHNOKDXvW2y+0WZE98m6XZi+ie/9nazjGYqFaotZbHvv5BUX1c4OqSt23oIqYnSebh/cidytg/RKays=@vger.kernel.org X-Gm-Message-State: AOJu0YxMeJDqG6ETFLrLGXpNvIHKCPCF89KUsaACCHzey8lp2ovusFb0 SH2XtTfQdpKLLSbWPu5TNlRzGeJAPv8kKSDn+OY2WAJhBH3HcX4hU/s+9M783MivJHIA X-Gm-Gg: AfdE7clHN20kf/D57toNLWV4AsCXkSFbx+ahhC8mzJAOboFrhGDLstZ9BYwr9POqTQW B2T39ghSlWIavmNtpWEl1dFZq2PBlTCRfW8KxjXFN5LpwLr5I+U9jOuwq87Ep9U6pyVlraiuF2H /utwmw9ewlS3Eo8kZWv3E/SvGSwEtcaLB5pDUe9Df6d1iTUScZwRTbAMUNoBrnmyuR5rzNiemzV MbbXwK+mA35qGQzX8t135GdJxMwKhVQI2/K1UjdZ78mKj/3GYMeqPrKKK6vZ0cDKcf2adWOazBh 7SeOgj2aRh8MWH0hca75yfDsqjUokSA7hMPiKZ1U1BQ5shgrSTkkCKV3y3MylrrHEDjHWtwSAn7 hzyjkZch0uRDwRioBgHQ5osvhik2UVLLnvU1H2kF8kC9DZUSHWGCoB5uLm9LQ1DoykhWqsfvURW LsY5SojAJbhHLdrg4JKRiDCsDRNZD8NuUhDPriaaaD/ohxzcs2sEGC8U+y3J7PjFjyuVxJmDnuS 3JksbY0AiFKr62mfqFHGFJPpU0tpMMUT9g= X-Received: by 2002:a05:6000:2004:b0:47a:c103:8a2e with SMTP id ffacd0b85a97d-47f2dce3062mr1867745f8f.45.1783754824681; Sat, 11 Jul 2026 00:27:04 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.218.188]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47aa0960b06sm66844821f8f.28.2026.07.11.00.27.03 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 11 Jul 2026 00:27:04 -0700 (PDT) From: Doruk Tan Ozturk To: David Heidelberg Cc: Simon Horman , oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net] nfc: llcp: reject PDUs shorter than the LLCP header Date: Sat, 11 Jul 2026 09:27:02 +0200 Message-ID: <20260711072702.70231-1-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nfc_llcp_rx_skb() reads the two-byte LLCP header (DSAP/SSAP/PTYPE) and dispatches by PDU type; several handlers then derive a TLV-array length as skb->len - LLCP_HEADER_SIZE. Neither nfc_llcp_rx_skb() nor its callers guarantee the frame is at least LLCP_HEADER_SIZE bytes, and a sub-header PDU does reach it: digital_in_recv_dep_res() and digital_tg_recv_dep_req() strip the DEP header with skb_pull() after only checking the DEP header size, so a DEP I-PDU carrying a 0- or 1-byte LLCP payload is handed up as a sub-2-byte skb. For a CONNECT or CC PDU, nfc_llcp_recv_connect() and nfc_llcp_recv_cc() then pass skb->len - LLCP_HEADER_SIZE to nfc_llcp_parse_connection_tlv(). For skb->len < 2 that subtraction underflows: truncated into the u16 tlv_array_len parameter it becomes ~0xFFFE, and for a CONNECT to the SDP SAP, nfc_llcp_connect_sn() uses a size_t and underflows to SIZE_MAX. The TLV parsers bound their walk relative to that length, so they read far past the end of the skb. The aggregated-frame path (nfc_llcp_recv_agf()) already drops sub-PDUs shorter than the header. Apply the same guard once, in the dispatcher, so every PDU type is covered. Found by 0sec (https://0sec.ai) using automated source analysis; the missing guard is evident from source. Compile-tested. Fixes: d646960f7986 ("NFC: Initial LLCP support") Cc: stable@vger.kernel.org Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk --- net/nfc/llcp_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index aed5fe1afef0..e3b3077e0e83 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1481,6 +1481,9 @@ static void nfc_llcp_rx_skb(struct nfc_llcp_local *lo= cal, struct sk_buff *skb) { u8 dsap, ssap, ptype; =20 + if (skb->len < LLCP_HEADER_SIZE) + return; + ptype =3D nfc_llcp_ptype(skb); dsap =3D nfc_llcp_dsap(skb); ssap =3D nfc_llcp_ssap(skb); --=20 2.43.0