diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-15 16:43:25 +0800 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-09-23 22:13:15 +0200 |
| commit | 686f942332b1667f13f3b8d6a2f50bcfbf42e277 (patch) | |
| tree | c3f84715143cab31b0909c688100d5e70e1c165a /drivers/nfc | |
| parent | fd73f4a6659897191fa0d40695fe370925dd3780 (diff) | |
| download | linux-next-686f942332b1667f13f3b8d6a2f50bcfbf42e277.tar.gz linux-next-686f942332b1667f13f3b8d6a2f50bcfbf42e277.zip | |
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.
Validate the complete helper command length before stripping the NCI
data header.
Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'drivers/nfc')
| -rw-r--r-- | drivers/nfc/nfcmrvl/fw_dnld.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c index 2b8f401d8fd7..8b9d5257320d 100644 --- a/drivers/nfc/nfcmrvl/fw_dnld.c +++ b/drivers/nfc/nfcmrvl/fw_dnld.c @@ -263,9 +263,14 @@ static int process_state_fw_dnld(struct nfcmrvl_private *priv, * B8..N: payload */ - /* Remove NCI HDR */ - skb_pull(skb, 3); - if (skb->data[0] != HELPER_CMD_PACKET_FORMAT || skb->len != 5) { + if (skb->len != NCI_DATA_HDR_SIZE + 5) { + nfc_err(priv->dev, "bad command"); + return -EINVAL; + } + + /* Remove NCI header */ + skb_pull(skb, NCI_DATA_HDR_SIZE); + if (skb->data[0] != HELPER_CMD_PACKET_FORMAT) { nfc_err(priv->dev, "bad command"); return -EINVAL; } |