[PATCH net v2] nfc: st-nci: align frame buffers for typed length load

[Runyu Xiao]

The ST NCI I2C and SPI transports parse a frame length from bytes
received from the controller. Both paths read the frame header into a
local u8 buffer and then cast buf + 2 to __be16 * before converting it
from big endian.

Align the local frame buffers to 2 bytes so that buf + 2 is also
2-byte aligned before the __be16 load. This keeps the existing parser
logic while making the alignment requirement explicit for the typed
length access.

This issue was detected by our static analysis tool and confirmed by
manual audit. UBSAN alignment validation of the same access shape,
be16_to_cpu(*(__be16 *)(buf + 2)), reports a misaligned-access load of
type '__be16' when the byte buffer does not provide that alignment.

Fixes: 35630df68d60 ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip")
Fixes: 2bc4d4f8c8f3 ("nfc: st-nci: Add spi phy support for st21nfcb")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
Changes in v2:
- Follow David's feedback and align the local I2C/SPI frame buffers
  instead of switching the length load to get_unaligned_be16().
- Use the original st21nfcb I2C driver commit in the I2C Fixes tag.

 drivers/nfc/st-nci/i2c.c | 2 +-
 drivers/nfc/st-nci/spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/st-nci/i2c.c b/drivers/nfc/st-nci/i2c.c
index 9ae839a6f5cc..b7e208dd5a18 100644
--- a/drivers/nfc/st-nci/i2c.c
+++ b/drivers/nfc/st-nci/i2c.c
@@ -108,7 +108,7 @@ static int st_nci_i2c_read(struct st_nci_i2c_phy *phy,
 {
 	int r;
 	u8 len;
-	u8 buf[ST_NCI_I2C_MAX_SIZE];
+	u8 buf[ST_NCI_I2C_MAX_SIZE] __aligned(2);
 	struct i2c_client *client = phy->i2c_dev;
 
 	r = i2c_master_recv(client, buf, ST_NCI_I2C_MIN_SIZE);
diff --git a/drivers/nfc/st-nci/spi.c b/drivers/nfc/st-nci/spi.c
index 169eacc0a32a..74b4ac39f65b 100644
--- a/drivers/nfc/st-nci/spi.c
+++ b/drivers/nfc/st-nci/spi.c
@@ -119,7 +119,7 @@ static int st_nci_spi_read(struct st_nci_spi_phy *phy,
 {
 	int r;
 	u8 len;
-	u8 buf[ST_NCI_SPI_MAX_SIZE];
+	u8 buf[ST_NCI_SPI_MAX_SIZE] __aligned(2);
 	struct spi_device *dev = phy->spi_dev;
 	struct spi_transfer spi_xfer = {
 		.rx_buf = buf,
-- 
2.34.1