nci_core_conn_create_rsp_packet() casts skb->data to struct nci_core_conn_create_rsp and accesses its conn_id, max_ctrl_pkt_payload_len, and credits_cnt fields (offsets 1-3) when the status byte is NCI_STATUS_OK. However, the NCI transport layer (nci_valid_size) only guarantees that the payload contains at least one byte. A malformed response with plen=1 and status=0 passes this check, and the handler then reads three bytes past the valid payload, using uninitialised slab data to populate the connection info that is later used for NFC data exchange. This can be triggered from userspace via the virtual_ncidev interface by injecting a short CORE_CONN_CREATE_RSP frame. Add a length check for the full response structure before accessing any field beyond the status byte. Fixes: 736bb9577407 ("NFC: nci: Support logical connections management") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Aamir Ahmed Reviewed-by: Simon Horman --- v2: - add the Assisted-by: LLM tag (Simon) - designate the target tree in the subject - collect Simon's Reviewed-by No code change. v1: https://lore.kernel.org/netdev/AS8P251MB00015EC8F8C2D4D9B536F94DC8B22@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/ Compile-tested only; I have no NFC hardware. net/nfc/nci/rsp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c index b0ab4f5acbce..72b748f0be9f 100644 --- a/net/nfc/nci/rsp.c +++ b/net/nfc/nci/rsp.c @@ -312,6 +312,10 @@ static void nci_core_conn_create_rsp_packet(struct nci_dev *ndev, pr_debug("status 0x%x\n", status); if (status == NCI_STATUS_OK) { + if (skb->len < sizeof(*rsp)) { + status = NCI_STATUS_SYNTAX_ERROR; + goto exit; + } rsp = (struct nci_core_conn_create_rsp *)skb->data; conn_info = devm_kzalloc(&ndev->nfc_dev->dev, base-commit: df2908090cda368b01ff43709f51890076c56157 -- 2.55.0