AZL-99483

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: fix out-of-bounds write in ncitargetauto_activated()

ncitargetautoactivated() appends a target to the fixed-size array ndev->targets[NCIMAXDISCOVEREDTARGETS] and increments ndev->ntargets without first checking the array is full; unlike its sibling nciaddnewtarget(), which bails out when ntargets already equals NCIMAXDISCOVEREDTARGETS.

ndev->ntargets is only cleared by ncicleartargetlist(), so an NFCC that repeatedly re-runs discovery (RFDISCOVERRSP, which re-enters NCIDISCOVERY without clearing the target list) and reports an auto-activated target (RFINTFACTIVATEDNTF) drives ntargets past the limit. The append then writes a struct nfctarget past the end of the array (a slab out-of-bounds write), and nfctargetsfound() goes on to walk the array with the inflated count:

BUG: KASAN: slab-out-of-bounds in nciaddnewprotocol+0x94/0x2ac [nci] Write of size 2 at addr ffff0000c7299a18 by task kworker/u8:0/12 Workqueue: nfc0ncirxwq ncirxwork [nci] Call trace: nciaddnewprotocol+0x94/0x2ac [nci] ncintfpacket+0xddc/0x11a0 [nci] ncirxwork+0x15c/0x1e0 [nci] processonework+0x2dc/0x500 workerthread+0x240/0x460 kthread+0x1c0/0x1d0 retfromfork+0x10/0x20

The buggy address belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1024 bytes to the right of allocated 1560-byte region [ffff0000c7299000, ffff0000c7299618)

Guard ncitargetautoactivated() with the same check used by nciaddnewtarget().