[PATCH] nfc: digital: check length before reading SENS_REQ

[Noah Weinberger]

Hello,

digital_tg_recv_sens_req() reads resp->data[0] into sens_req before the
!resp->len check in the very next statement, so an empty frame reads one
byte past skb->len. The patch simply reorders the check (the ||
short-circuit then makes the read unreachable on empty frames) and drops
the now-unused local.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/nfc/digital_technology.c:1088-1112 (digital_tg_recv_sens_req).
Longstanding code.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index ae6487c..d9a8e9f 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -1088,7 +1088,6 @@ static int digital_tg_send_sens_res(struct nfc_digital_dev *ddev)
 void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,
 			      struct sk_buff *resp)
 {
-	u8 sens_req;
 	int rc;
 
 	if (IS_ERR(resp)) {
@@ -1097,10 +1096,8 @@ void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,
 		goto exit;
 	}
 
-	sens_req = resp->data[0];
-
-	if (!resp->len || (sens_req != DIGITAL_CMD_SENS_REQ &&
-	    sens_req != DIGITAL_CMD_ALL_REQ)) {
+	if (!resp->len || (resp->data[0] != DIGITAL_CMD_SENS_REQ &&
+	    resp->data[0] != DIGITAL_CMD_ALL_REQ)) {
 		rc = -EINVAL;
 		goto exit;
 	}