Re: [PATCH net v3] nfc: digital: check DEP_REQ length before reading DID byte
From: Aamir Ahmed <hidden>
Date: 2026-09-13 21:07:23
Also in:
lkml, oe-linux-nfc, stable
On Sun, Sep 13, 2026 at 09:24:26PM +0100, Aamir Ahmed wrote:
digital_tg_recv_dep_req() reads resp->data[3] when the DID bit is set
in the PFB, but only sizeof(struct digital_dep_req_res) bytes (3) are
guaranteed by the preceding length check. A crafted DEP_REQ that is
exactly 3 bytes long with the DID bit set causes an out-of-bounds read
past the valid skb data.
This read can happen on every DEP_REQ from a malicious NFC initiator
when the target device has a non-zero DID. The stale byte is compared
against ddev->did, so in practice the mismatch causes an -EIO return,
but the read itself is undefined behavior and accesses data past the
buffer.
Reorder the condition so that the length check (resp->len < size + 1)
comes first and short-circuits before resp->data[size] is accessed.
The later "size > resp->len" check becomes redundant and is left in
place.
Fixes: 05afedcb8918 ("NFC: digital: Add Target-mode NFC-DEP DID Support")+Cc Mark Greer, author of 05afedcb8918, which the Fixes: tag in this version points at. I missed adding him when correcting the tag.
quoted hunk ↗ jump to hunk
Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Aamir Ahmed <redacted> Reviewed-by: Simon Horman <horms@kernel.org> --- v3: - correct the Fixes: tag; the bug came in with 05afedcb8918 - reword the note on the later "size > resp->len" check, which returns early for NAD frames and is now redundant rather than preserved for that case No code change; Simon's Reviewed-by carried. v2: https://lore.kernel.org/netdev/AS8P251MB0001F45C42BBD0D16D7B30ABC8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/ (local) - add the Assisted-by: LLM tag (Simon) - designate the target tree in the subject - collect Simon's Reviewed-by v1: https://lore.kernel.org/netdev/AS8P251MB000196084524EB27D62162B8C8B32@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/ (local) Compile-tested only; I have no NFC hardware. net/nfc/digital_dep.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c index 3982fa084737..ae5407fca12d 100644 --- a/net/nfc/digital_dep.c +++ b/net/nfc/digital_dep.c@@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, pfb = dep_req->pfb; if (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) { - if (ddev->did && (ddev->did == resp->data[3])) { - size++; - } else { + if (resp->len < size + 1 || !ddev->did || + ddev->did != resp->data[size]) { rc = -EIO; goto exit; } + size++; } else if (ddev->did) { rc = -EIO; goto exit;base-commit: df2908090cda368b01ff43709f51890076c56157
Kind Regards Aamir A.