Re: [PATCH net v2] nfc: llcp: bound the connect_sn TLV walk to the skb

On Thu, Jul 09, 2026 at 03:12:29PM +0200, Doruk Tan Ozturk wrote:
> Commit 27256cdb290e ("nfc: llcp: bound SNL TLV parsing to the skb and
> add length checks") fixed the unbounded TLV walk in nfc_llcp_recv_snl(),
> and commit d8bd2dedbde5 ("nfc: llcp: fix OOB read and u8 offset wrap in
> TLV parsers") subsequently bounded nfc_llcp_parse_gb_tlv() and
> nfc_llcp_parse_connection_tlv(). One sibling parser sharing the same
> pattern remains unbounded: nfc_llcp_connect_sn().
> 
> nfc_llcp_connect_sn() walks a TLV list, reading a two-byte header
> (type, length) followed by length bytes of value, without checking that
> the two header bytes or the declared length stay within the buffer. It
> returns a pointer to a service name of up to 255 bytes that may point
> past the end of the skb; it is subsequently consumed by memcmp() in
> nfc_llcp_sock_from_sn(). In addition tlv_array_len was computed as
> "skb->len - LLCP_HEADER_SIZE" in size_t, so a CONNECT/CC frame shorter
> than the LLCP header underflows to a huge length and the walk runs far
> past the buffer.
> 
> nfc_llcp_connect_sn() is reachable from nfc_llcp_recv_connect() and
> nfc_llcp_recv_cc(), i.e. from received CONNECT and CC PDUs. A nearby
> NFC device can reach this without authentication; LLCP link activation
> happens automatically after NFC-DEP, and the nfc_llcp_rx_skb()
> dispatcher applies no minimum-length guard.
> 
> Walk the TLV list by pointer, bounded by skb_tail_pointer(skb), and
> validate each declared length before use, matching the approach already
> used for nfc_llcp_recv_snl(). Starting the walk at
> &skb->data[LLCP_HEADER_SIZE] against the tail pointer also removes the
> size_t underflow for short frames.
> 
> Found by 0sec automated security-research tooling (https://0sec.ai).
> 
> Fixes: d646960f7986 ("NFC: Initial LLCP support")
> Cc: [email protected]
> Assisted-by: 0sec:claude-opus-4-8
> Signed-off-by: Doruk Tan Ozturk <[email protected]>
> ---
> v2: drop the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv()
>     hunks - fixed independently by d8bd2dedbde5. This resend covers only
>     the still-unbounded nfc_llcp_connect_sn().
> v1: https://lore.kernel.org/netdev/20260705113505 net/nfc/llcp_core.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)

Reviewed-by: Simon Horman <[email protected]>