[PATCH net 2/2] nfc: llcp: add missing bounds checks in nfc_llcp_recv_snl()

[Muhammad Bilal]

nfc_llcp_recv_snl() processes remotely supplied SNL frames without
validating TLV buffer boundaries before accessing header and value
bytes, leading to three issues:

1. No bounds check before reading tlv[0] (type) and tlv[1] (length).
   When tlv_len - offset == 1, reading tlv[1] accesses one byte past
   the end of the skb data.

2. For LLCP_TLV_SDREQ entries, tlv[2] (tid) and tlv[3+]
   (service_name) are read without checking offset+2+length <= tlv_len,
   allowing out-of-bounds reads beyond the skb data boundary.

3. service_name_len = length - 1 with length as u8 and service_name_len
   as size_t. When length == 0, the subtraction yields SIZE_MAX on
   64-bit kernels due to integer promotion. The computed SIZE_MAX value
   is propagated into nfc_llcp_sock_from_sn() as sn_len, bypassing the
   sn_len == 0 guard and reaching subsequent comparison logic with an
   excessively large length argument.

Fix all three issues by:
  - Adding a header bounds check before reading tlv[0]/tlv[1].
  - Adding a value bounds check after reading length.
  - Rejecting SDREQ TLVs with length < 1 to prevent the SIZE_MAX
    underflow, while preserving length == 1 as a valid case.
  - Rejecting SDRES TLVs with length < 2 since both tlv[2] and
    tlv[3] are required.

Fixes: 19cfe5843e86 ("NFC: Initial SNL support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Muhammad Bilal <meatuni001@xxxxxxxxx>
---
 net/nfc/llcp_core.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a87..da7c6377d 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1300,12 +1300,28 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 	sdres_tlvs_len = 0;
 
 	while (offset < tlv_len) {
-		type = tlv[0];
+		if (offset + 2 > tlv_len) {
+			pr_err("Truncated TLV header at offset %u\n", offset);
+			goto exit;
+		}
+
+		type   = tlv[0];
 		length = tlv[1];
 
+		if (offset + 2 + length > tlv_len) {
+			pr_err("TLV length %u overflows buffer at offset %u\n",
+			       length, offset);
+			goto exit;
+		}
+
 		switch (type) {
 		case LLCP_TLV_SDREQ:
-			tid = tlv[2];
+			if (length < 1) {
+				pr_err("SDREQ TLV length %u too short\n", length);
+				goto exit;
+			}
+
+			tid          = tlv[2];
 			service_name = (char *) &tlv[3];
 			service_name_len = length - 1;
 
@@ -1369,6 +1385,9 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 			break;
 
 		case LLCP_TLV_SDRES:
+			if (length < 2)
+				break;
+
 			mutex_lock(&local->sdreq_lock);
 
 			pr_debug("LLCP_TLV_SDRES: searching tid %d\n", tlv[2]);
-- 
2.54.0