Re: [PATCH net] nfc: port100: reject frames whose declared length exceeds the received data

[Simon Horman <horms@kernel.org>]

On Sat, Jul 11, 2026 at 02:36:51PM +0200, Doruk Tan Ozturk wrote:
> port100_recv_response() passes the URB transfer buffer to
> port100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)
> bytes of frame->data. datalen is a 16-bit field supplied by the device
> and is never checked against the number of bytes actually received
> (urb->actual_length), so a device reporting a datalen larger than the
> received frame makes port100_data_checksum() read out of bounds past the
> transfer buffer.
> 
> Reject a response whose declared frame size does not fit the received
> length before validating it.
> 
> Found by 0sec (https://0sec.ai) using automated source analysis; the
> missing bound is evident from source. Compile-tested.
> 
> Fixes: 562d4d59b8a1 ("NFC: Sony Port-100 Series driver")
> Cc: stable@vger.kernel.org
> Assisted-by: 0sec:claude-opus-4-8
> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>

Reviewed-by: Simon Horman <horms@kernel.org>

FTR, I do not believe the issues raised in the AI-generated review of this
patch on sashiko.dev should impede the progress of this patch. Rather, I
think those issues can be considered in the context of possible follow-up.