Re: [PATCH] nfc: digital: check DEP_REQ length before reading DID byte

[Simon Horman]

On Mon, Sep 07, 2026 at 12:36:54AM +0100, Aamir Ahmed wrote:
> digital_tg_recv_dep_req() reads resp->data[3] when the DID bit is set
> in the PFB, but only sizeof(struct digital_dep_req_res) bytes (3) are
> guaranteed by the preceding length check.  A crafted DEP_REQ that is
> exactly 3 bytes long with the DID bit set causes an out-of-bounds read
> past the valid skb data.
> 
> This read can happen on every DEP_REQ from a malicious NFC initiator
> when the target device has a non-zero DID.  The stale byte is compared
> against ddev->did, so in practice the mismatch causes an -EIO return,
> but the read itself is undefined behavior and accesses data past the
> buffer.
> 
> Reorder the condition so that the length check (resp->len < size + 1)
> comes first and short-circuits before resp->data[size] is accessed.
> The existing fallthrough to the later "size > resp->len" check is
> preserved for the NAD case.
> 
> Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>

This patch looks good to me but as noted collectively by Greg and Paolo
elsewhere:
1. Please include an Assisted-by tag
2. Please keep the number of patches in-flight to 15 or less

When you repost feel free to include:

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

-- 
pw-bot: changes-requested