From nobody Tue Sep 29 00:33:34 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A48F6435EC8 for ; Fri, 14 Aug 2026 08:10:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786695022; cv=none; b=W8VDyQgxohweXxYO79hrWahHhmZVZo5kBQp2eCeX+2I6/rxjodFwh4JUEaf3sC+2P5SUtnoLHc8JUV1B9J0Tl8D9OAXr7MF1VoUXk+CVdGHGP9cWXmsPz90AoI60RFrPhd8ef41HAetBEh3/JkWxrvBUPmdhDKXJVzQ1OW4bSnA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786695022; c=relaxed/simple; bh=rnSNoFO/6kHruN5298hAyYlHXWgkCQf5zyKM4OxaDTw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=ruzhhNt1NUAfNt9sDunHTF+ATTLiVOQccWTN/CsriS8358fU+S1BErUBhCAy56pnz0SRs9zzQ+tfhD7DLgBQtzb5oCE4DGX/On6HZZavUnRe/JzhnL642mWpJXCwz1RbBfP4aV82+cvtpJTUejh89g3Q2ZyjYBNXopwgktIy+jA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowABnPfFlzX5qswifBQ--.31406S2; Fri, 14 Aug 2026 16:10:13 +0800 (CST) From: Pengpeng Hou To: David Heidelberg Cc: Samuel Ortiz , Christophe Ricard , oe-linux-nfc@lists.linux.dev, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2] nfc: st21nfca: validate received frame before unstuffing Date: Fri, 14 Aug 2026 16:10:12 +0800 Message-ID: <20260814081012.24565-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowABnPfFlzX5qswifBQ--.31406S2 X-Coremail-Antispam: 1UD129KBjvJXoW7ur1ftF4UWry8Zw4fuFWkXrb_yoW5JFWUpF WfKry5Xr4Dtr43trs8uF4rZa45G3s5KryakFy7Ka4fZa1YkF15XFWFka109F12yrWrCa4U ArWkXF45uw1qya7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvj14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26r xl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r1q6rW5McIj6I8E87Iv67AKxVW8JVWxJwAm72CE4IkC6x0Yz7v_Jr 0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7MxkF7I0En4kS14v2 6r126r1DMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrV AFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCI c40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r4j6ryUMIIF0xvE2Ix0cI8IcVCY1x0267 AKxVWxJVW8Jr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r4j 6F4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJbIYCTnIWIevJa73UjIFyTuYvjfU8- B_UUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ st21nfca_hci_i2c_repack() trims a frame at EOF and then assumes the remaining data contains the LLC header and CRC bytes. Its byte-unstuffing loop also reads the byte after every escape marker without checking that one remains. Validate the minimum frame before and after unstuffing, use separate input and output cursors, and reject a trailing escape before CRC processing. Fixes: 3096e25a3e40 ("NFC: st21nfca: Fix incorrect byte stuffing revocation= ") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- Changes since v1: https://lore.kernel.org/all/20260715084405.41546-1-pengpe= ng@iscas.ac.cn/ - no source-code changes - rebase on the current NFC sources and tighten the commit message - add the coding-assistant disclosure The start, EOF, stuffing and CRC extents were reviewed statically; no ST21NFCA hardware or malformed frame test was performed. drivers/nfc/st21nfca/i2c.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c index aa5f4922b6b0..11ba4fb49828 100644 --- a/drivers/nfc/st21nfca/i2c.c +++ b/drivers/nfc/st21nfca/i2c.c @@ -289,27 +289,36 @@ static int check_crc(u8 *buf, int buflen) */ static int st21nfca_hci_i2c_repack(struct sk_buff *skb) { - int i, j, r, size; + int read, write, r, size; =20 - if (skb->len < 1 || (skb->len > 1 && skb->data[1] !=3D 0)) + if (skb->len < ST21NFCA_FRAME_HEADROOM || + !IS_START_OF_FRAME(skb->data)) return -EBADMSG; =20 size =3D get_frame_size(skb->data, skb->len); if (size > 0) { + if (size < ST21NFCA_FRAME_HEADROOM + 2) + return -EBADMSG; + skb_trim(skb, size); /* remove ST21NFCA byte stuffing for upper layer */ - for (i =3D 1, j =3D 0; i < skb->len; i++) { - if (skb->data[i + j] =3D=3D + for (read =3D 1, write =3D 1; read < skb->len;) { + if (skb->data[read] =3D=3D (u8) ST21NFCA_ESCAPE_BYTE_STUFFING) { - skb->data[i] =3D skb->data[i + j + 1] - | ST21NFCA_BYTE_STUFFING_MASK; - i++; - j++; + if (read + 1 =3D=3D skb->len) + return -EBADMSG; + + skb->data[write++] =3D skb->data[read + 1] + | ST21NFCA_BYTE_STUFFING_MASK; + read +=3D 2; + } else { + skb->data[write++] =3D skb->data[read++]; } - skb->data[i] =3D skb->data[i + j]; } /* remove byte stuffing useless byte */ - skb_trim(skb, i - j); + skb_trim(skb, write); + if (skb->len < ST21NFCA_FRAME_HEADROOM + 2) + return -EBADMSG; /* remove ST21NFCA_SOF_EOF from head */ skb_pull(skb, 1); =20 --=20 2.50.1 (Apple Git-155)