diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-15 16:43:25 +0800 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-08-31 19:09:04 +0200 |
| commit | 5497dcee4c8a42a220e5eab282899e5ebbd3fc0b (patch) | |
| tree | a4a39f4b670bae78e59b6df58083766392fc3b1d /drivers | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-next-5497dcee4c8a42a220e5eab282899e5ebbd3fc0b.tar.gz linux-next-5497dcee4c8a42a220e5eab282899e5ebbd3fc0b.zip | |
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.
Validate the complete helper command length before stripping the NCI
data header.
Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/nfc/nfcmrvl/fw_dnld.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c index 2b8f401d8fd7..8b9d5257320d 100644 --- a/drivers/nfc/nfcmrvl/fw_dnld.c +++ b/drivers/nfc/nfcmrvl/fw_dnld.c @@ -263,9 +263,14 @@ static int process_state_fw_dnld(struct nfcmrvl_private *priv, * B8..N: payload */ - /* Remove NCI HDR */ - skb_pull(skb, 3); - if (skb->data[0] != HELPER_CMD_PACKET_FORMAT || skb->len != 5) { + if (skb->len != NCI_DATA_HDR_SIZE + 5) { + nfc_err(priv->dev, "bad command"); + return -EINVAL; + } + + /* Remove NCI header */ + skb_pull(skb, NCI_DATA_HDR_SIZE); + if (skb->data[0] != HELPER_CMD_PACKET_FORMAT) { nfc_err(priv->dev, "bad command"); return -EINVAL; } |