[PATCH] nfc: nci: Fix zero-length proprietary OIDs

[Ian Ray]

NCI NFC controllers may have proprietary OIDs with zero-length payload.
One example is [1], [2].

Allow a zero length payload in proprietary OIDs *only* - note that this
change does *not* impact standard OIDs (which must have non-zero length
due to the earlier uninit-value fix).

Before:

-- >8 --
kernel: nci: nci_recv_frame: len 3
-- >8 --

After:

-- >8 --
kernel: nci: nci_recv_frame: len 3
kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x23, plen=0
kernel: nci: nci_ntf_packet: unknown ntf opcode 0x123
kernel: nfc nfc0: NFC: RF transmitter couldn't start. Bad power and/or configuration?
-- >8 --

[1] drivers/nfc/nxp-nci/core.c
[2] NXP_NCI_RF_TXLDO_ERROR_NTF

Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
Signed-off-by: Ian Ray <ian.ray@xxxxxxxxxxxxxxxx>
---
 net/nfc/nci/core.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index e419e020a70a..78da0fb9ef3f 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1482,10 +1482,16 @@ static bool nci_valid_size(struct sk_buff *skb)
 	unsigned int hdr_size = NCI_CTRL_HDR_SIZE;
 
 	if (skb->len < hdr_size ||
-	    !nci_plen(skb->data) ||
 	    skb->len < hdr_size + nci_plen(skb->data)) {
 		return false;
 	}
+
+	/* Require non-zero length for standard OIDs (0x00 - 0x1F).
+	 * But allow zero length in the proprietary range (0x20 - 0x3F). */
+	if (!nci_plen(skb->data))
+		if (nci_opcode_oid(nci_opcode(skb->data)) <= 0x1F)
+			return false;
+
 	return true;
 }
 
-- 
2.49.0