Commit fd734e84 authored by Dan Carpenter's avatar Dan Carpenter Committed by Yang Yingliang
Browse files

NFC: nci: Add bounds checking in nci_hci_create_pipe() 

mainline inclusion
from mainline-v6.14-rc1
commit 110b43ef05342d5a11284cc8b21582b698b4ef1c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8J
CVE: CVE-2025-21735

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=110b43ef05342d5a11284cc8b21582b698b4ef1c



--------------------------------

The "pipe" variable is a u8 which comes from the network.  If it's more
than 127, then it results in memory corruption in the caller,
nci_hci_connect_gate().

Cc: stable@vger.kernel.org
Fixes: a1b0b941 ("NFC: nci: Create pipe on specific gate in nci_hci_connect_gate")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mountain


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 2c111a42

net/nfc/nci/hci.c

+2 −0
Original line number Diff line number Diff line
@@ -548,6 +548,8 @@ static u8 nci_hci_create_pipe(struct nci_dev *ndev, u8 dest_host, 


	pr_debug("pipe created=%d\n", pipe);



	if (pipe >= NCI_HCI_MAX_PIPES)

		pipe = NCI_HCI_INVALID_PIPE;

	return pipe;

}