Re: [PATCH net] nfc: port100: reject frames whose declared length exceeds the received data

On Sat, Jul 11, 2026 at 02:36:51PM +0200, Doruk Tan Ozturk wrote:

port100_recv_response() passes the URB transfer buffer to
port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)
bytes of frame->data. datalen is a 16-bit field supplied by the device
and is never checked against the number of bytes actually received
(urb->actual_length), so a device reporting a datalen larger than the
received frame makes port100_data_checksum() read out of bounds past the
transfer buffer.

Reject a response whose declared frame size does not fit the received
length before validating it.

Found by 0sec (https://0sec.ai) using automated source analysis; the
missing bound is evident from source. Compile-tested.

Fixes: 562d4d59b8a1 ("NFC: Sony Port-100 Series driver")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:claude-opus-4-8
Signed-off-by: Doruk Tan Ozturk <redacted>

Reviewed-by: Simon Horman <horms@kernel.org>

FTR, I do not believe the issues raised in the AI-generated review of this
patch on sashiko.dev should impede the progress of this patch. Rather, I
think those issues can be considered in the context of possible follow-up.