[PATCH net 2/4] nfc: digital: Fix check-after-read in digital_tg_recv_sens_req()

Lekë Hapçiu
2026-04-09T22:35:12Z

digital_tg_recv_sens_req() reads resp->data[0] into sens_req at line
1092 before the !resp->len guard fires at line 1094. A zero-length
frame causes an unconditional 1-byte out-of-bounds read before any
length check has taken place.

The root cause is that the assignment and the length check are split
across two statements: resp->data[0] is read unconditionally into
sens_req, and only then is resp->len tested as part of a compound
condition. Even though the || operator correctly short-circuits, the
read on the previous line is already done.

Move the length guard before the data access by splitting the combined
condition into an early resp->len check followed by the data read and
the command comparison.

Fixes: 2e7a3e7ee80d ("NFC Digital: Add target mode for NFC-A/ISO14443A")
Cc: stable@vger.kernel.org
Signed-off-by: Lekë Hapçiu <snowwlake@icloud.com>
---
net/nfc/digital_technology.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index XXXXXXX..XXXXXXX 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -1090,11 +1090,14 @@ void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg,
}

- sens_req = resp->data[0];
-
- if (!resp->len || (sens_req != DIGITAL_CMD_SENS_REQ &&
- sens_req != DIGITAL_CMD_ALL_REQ)) {
+ if (!resp->len) {
rc = -EINVAL;
goto exit;
}
+
+ sens_req = resp->data[0];
+ if (sens_req != DIGITAL_CMD_SENS_REQ && sens_req != DIGITAL_CMD_ALL_REQ) {
+ rc = -EINVAL;
+ goto exit;
+ }

rc = digital_tg_send_sens_res(ddev);
--
2.34.1