Re: [PATCH] nfc: nci: validate CORE_CONN_CREATE response length before reading fields

[Simon Horman]

On Mon, Sep 07, 2026 at 06:28:55AM +0000, Aamir Ahmed wrote:
> nci_core_conn_create_rsp_packet() casts skb->data to struct
> nci_core_conn_create_rsp and accesses its conn_id,
> max_ctrl_pkt_payload_len, and credits_cnt fields (offsets 1-3) when
> the status byte is NCI_STATUS_OK.  However, the NCI transport layer
> (nci_valid_size) only guarantees that the payload contains at least
> one byte.  A malformed response with plen=1 and status=0 passes this
> check, and the handler then reads three bytes past the valid payload,
> using uninitialised slab data to populate the connection info that is
> later used for NFC data exchange.
> 
> This can be triggered from userspace via the virtual_ncidev interface
> by injecting a short CORE_CONN_CREATE_RSP frame.
> 
> Add a length check for the full response structure before accessing
> any field beyond the status byte.
> 
> Fixes: 736bb9577407 ("NFC: nci: Support logical connections management")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>

This patch looks good to me but as noted collectively by Greg and Paolo
elsewhere:
1. Please include an Assisted-by tag
2. Please keep the number of patches in-flight to 15 or less

When you repost feel free to include:

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

-- 
pw-bot: changes-requested