nfc_llcp_recv_dm() reads the reason byte at skb->data[2], and nfc_llcp_recv_hdlc() reads the sequence byte at the same offset through nfc_llcp_ns() and nfc_llcp_nr(). Both run after __nfc_llcp_recv(), which only guarantees LLCP_HEADER_SIZE (2) bytes via pskb_may_pull(). A malformed PDU that is exactly two bytes long -- delivered directly by the NFC controller, or as an aggregated PDU inside an AGF frame whose inner length field is 2 -- causes both handlers to read one byte past the guaranteed data. In the direct case the byte is whatever follows the valid payload in the skb buffer. In the AGF case the inner skb is allocated by nfc_alloc_recv_skb() with exactly two bytes of payload, so the read is past the meaningful data and into whatever the slab allocator left there. For DM, the stale reason byte selects between NOBOUND/REJ and the default socket-lookup path, potentially closing the wrong socket. For HDLC, the stale sequence byte corrupts N(S)/N(R) tracking: a bogus N(R) drains the tx_pending_queue unconditionally, dropping in-flight I frames and breaking the connection. Add a minimum-length check to each handler: DM requires LLCP_HEADER_SIZE + 1 (the reason byte) and HDLC requires LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE. Fixes: d646960f7986 ("NFC: Initial LLCP support") Cc: stable@vger.kernel.org Signed-off-by: Aamir Ahmed --- net/nfc/llcp_core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index cac1b5487064..89d6f4599e11 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1077,6 +1077,12 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local, ptype = nfc_llcp_ptype(skb); dsap = nfc_llcp_dsap(skb); ssap = nfc_llcp_ssap(skb); + + if (skb->len < LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE) { + nfc_llcp_send_dm(local, dsap, ssap, LLCP_DM_NOCONN); + return; + } + ns = nfc_llcp_ns(skb); nr = nfc_llcp_nr(skb); @@ -1254,6 +1260,10 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, dsap = nfc_llcp_dsap(skb); ssap = nfc_llcp_ssap(skb); + + if (skb->len < LLCP_HEADER_SIZE + 1) + return; + reason = skb->data[2]; pr_debug("%d %d reason %d\n", ssap, dsap, reason); -- 2.43.0