Re: [PATCH] nfc: llcp: validate PDU size in nfc_llcp_recv_dm() and nfc_llcp_recv_hdlc()

[Greg KH]

On Mon, Sep 07, 2026 at 12:36:45AM +0100, Aamir Ahmed wrote:
> nfc_llcp_recv_dm() reads the reason byte at skb->data[2], and
> nfc_llcp_recv_hdlc() reads the sequence byte at the same offset
> through nfc_llcp_ns() and nfc_llcp_nr().  Both run after
> __nfc_llcp_recv(), which only guarantees LLCP_HEADER_SIZE (2) bytes
> via pskb_may_pull().
> 
> A malformed PDU that is exactly two bytes long -- delivered directly by
> the NFC controller, or as an aggregated PDU inside an AGF frame whose
> inner length field is 2 -- causes both handlers to read one byte past
> the guaranteed data.  In the direct case the byte is whatever follows
> the valid payload in the skb buffer.  In the AGF case the inner skb is
> allocated by nfc_alloc_recv_skb() with exactly two bytes of payload, so
> the read is past the meaningful data and into whatever the slab
> allocator left there.
> 
> For DM, the stale reason byte selects between NOBOUND/REJ and the
> default socket-lookup path, potentially closing the wrong socket.  For
> HDLC, the stale sequence byte corrupts N(S)/N(R) tracking: a bogus
> N(R) drains the tx_pending_queue unconditionally, dropping in-flight I
> frames and breaking the connection.
> 
> Add a minimum-length check to each handler: DM requires
> LLCP_HEADER_SIZE + 1 (the reason byte) and HDLC requires
> LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE.
> 
> Fixes: d646960f7986 ("NFC: Initial LLCP support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
> ---
>  net/nfc/llcp_core.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)

For all of these different patches, did you forget to add the required
"Assisted-by:" tag?

Please resubmit them all with that included.

thanks,

greg k-h