[PATCH] nfc: llcp: pull DM reason byte before use

[Noah Weinberger]

Hello,

__nfc_llcp_recv() only pulls the two-byte LLCP header before
dispatching, but nfc_llcp_recv_dm() reads skb->data[2] for the DM
reason code. A two-byte DM PDU (or the AGF-wrapped equivalent) from a
remote peer therefore reads one byte past skb->len. The HDLC handler
pulls its extra byte; the DM handler does not.

With current drivers the read stays inside the over-allocated skb, so
this is a KMSAN-visible uninitialized read rather than a slab overread,
and the value only steers the reason-code switch. The patch pulls the
extra byte first.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/nfc/llcp_core.c:1278-1290 (nfc_llcp_recv_dm), llcp_core.c:1620-1633 (caller's pull).
Longstanding code.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 74bf817..733e643 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1276,13 +1276,16 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
 }
 
 static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
-			     const struct sk_buff *skb)
+			     struct sk_buff *skb)
 {
 	struct nfc_llcp_sock *llcp_sock;
 	struct sock *sk;
 	u8 dsap, ssap, reason;
 	bool connecting = false;
 
+	if (!pskb_may_pull(skb, LLCP_HEADER_SIZE + 1))
+		return;
+
 	dsap = nfc_llcp_dsap(skb);
 	ssap = nfc_llcp_ssap(skb);
 	reason = skb->data[2];