[PATCH net] nfc: llcp: fix SNL PDU size truncation in nfc_llcp_allocate_snl()

[Linkui Xiao]

From: Linkui Xiao <xiaolinkui@xxxxxxxxxx>

nfc_llcp_allocate_snl() sums the requested TLV payload length into a u16
variable before passing it to alloc_skb(), but its tlv_length argument
is a size_t and callers pass a length bounded only by the size of the
netlink message that produced it.

nfc_genl_llc_sdreq() walks the nested NFC_ATTR_LLC_SDP attributes of a
GENL_ADMIN_PERM request, builds one SDREQ TLV per attribute and sums
their lengths into the size_t tlvs_len. Each URI is capped at
U8_MAX - 4 bytes by nfc_sdp_genl_policy, so every TLV fits in its u8
tlv_len, but nothing caps the number of attributes, so tlvs_len can
exceed U16_MAX.

When it does, the u16 accumulator wraps and alloc_skb() returns a
buffer that is far too small. nfc_llcp_send_snl_sdreq() then calls
skb_put_data() once per TLV and writes all tlvs_len bytes into it,
which trips skb_over_panic() and panics the machine.

Use size_t for the accumulated size so that it can no longer wrap
before the allocation. alloc_skb() takes an unsigned int, which is
still wide enough for any length a netlink message can carry.

Fixes: e0ae7bac06cc ("NFC: llcp: Service Name Lookup SDRES aggregation")
Reported-by: Guikun Yang <yangguikun19@xxxxxx>
Link: https://lore.kernel.org/netdev/tencent_634C55A23C7CCCA3985283BFED46A69C9E09@xxxxxx/
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Linkui Xiao <xiaolinkui@xxxxxxxxxx>
---
 net/nfc/llcp_commands.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 80a00938c869..0a3d66e6cd59 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -542,7 +542,7 @@ static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
 {
 	struct sk_buff *skb;
 	struct nfc_dev *dev;
-	u16 size = 0;
+	size_t size = 0;
 
 	if (local == NULL)
 		return ERR_PTR(-ENODEV);
-- 
2.25.1