[PATCH net v3] nfc: digital: check DEP_REQ length before reading DID byte

[PATCH net v3] nfc: digital: check DEP_REQ length before reading DID byte

[Aamir Ahmed]

digital_tg_recv_dep_req() reads resp->data[3] when the DID bit is set
in the PFB, but only sizeof(struct digital_dep_req_res) bytes (3) are
guaranteed by the preceding length check.  A crafted DEP_REQ that is
exactly 3 bytes long with the DID bit set causes an out-of-bounds read
past the valid skb data.

This read can happen on every DEP_REQ from a malicious NFC initiator
when the target device has a non-zero DID.  The stale byte is compared
against ddev->did, so in practice the mismatch causes an -EIO return,
but the read itself is undefined behavior and accesses data past the
buffer.

Reorder the condition so that the length check (resp->len < size + 1)
comes first and short-circuits before resp->data[size] is accessed.
The later "size > resp->len" check becomes redundant and is left in
place.

Fixes: 05afedcb8918 ("NFC: digital: Add Target-mode NFC-DEP DID Support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Reviewed-by: Simon Horman <horms@kernel.org>
---
v3:
  - correct the Fixes: tag; the bug came in with 05afedcb8918
  - reword the note on the later "size > resp->len" check, which
    returns early for NAD frames and is now redundant rather than
    preserved for that case
  No code change; Simon's Reviewed-by carried.
v2: https://lore.kernel.org/netdev/AS8P251MB0001F45C42BBD0D16D7B30ABC8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/
  - add the Assisted-by: LLM tag (Simon)
  - designate the target tree in the subject
  - collect Simon's Reviewed-by
v1: https://lore.kernel.org/netdev/AS8P251MB000196084524EB27D62162B8C8B32@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/

Compile-tested only; I have no NFC hardware.

 net/nfc/digital_dep.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 3982fa084737..ae5407fca12d 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
 	pfb = dep_req->pfb;

 	if (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {
-		if (ddev->did && (ddev->did == resp->data[3])) {
-			size++;
-		} else {
+		if (resp->len < size + 1 || !ddev->did ||
+		    ddev->did != resp->data[size]) {
 			rc = -EIO;
 			goto exit;
 		}
+		size++;
 	} else if (ddev->did) {
 		rc = -EIO;
 		goto exit;

base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.55.0

Re: [PATCH net v3] nfc: digital: check DEP_REQ length before reading DID byte

[Aamir Ahmed]

On Sun, Sep 13, 2026 at 09:24:26PM +0100, Aamir Ahmed wrote:
> digital_tg_recv_dep_req() reads resp->data[3] when the DID bit is set
> in the PFB, but only sizeof(struct digital_dep_req_res) bytes (3) are
> guaranteed by the preceding length check.  A crafted DEP_REQ that is
> exactly 3 bytes long with the DID bit set causes an out-of-bounds read
> past the valid skb data.
>
> This read can happen on every DEP_REQ from a malicious NFC initiator
> when the target device has a non-zero DID.  The stale byte is compared
> against ddev->did, so in practice the mismatch causes an -EIO return,
> but the read itself is undefined behavior and accesses data past the
> buffer.
>
> Reorder the condition so that the length check (resp->len < size + 1)
> comes first and short-circuits before resp->data[size] is accessed.
> The later "size > resp->len" check becomes redundant and is left in
> place.
>
> Fixes: 05afedcb8918 ("NFC: digital: Add Target-mode NFC-DEP DID Support")

+Cc Mark Greer, author of 05afedcb8918, which the Fixes: tag in this
version points at. I missed adding him when correcting the tag.

> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
> Reviewed-by: Simon Horman <horms@kernel.org>
> ---
> v3:
>   - correct the Fixes: tag; the bug came in with 05afedcb8918
>   - reword the note on the later "size > resp->len" check, which
>     returns early for NAD frames and is now redundant rather than
>     preserved for that case
>   No code change; Simon's Reviewed-by carried.
> v2: https://lore.kernel.org/netdev/AS8P251MB0001F45C42BBD0D16D7B30ABC8BD2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/
>   - add the Assisted-by: LLM tag (Simon)
>   - designate the target tree in the subject
>   - collect Simon's Reviewed-by
> v1: https://lore.kernel.org/netdev/AS8P251MB000196084524EB27D62162B8C8B32@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM/
>
> Compile-tested only; I have no NFC hardware.
>
>  net/nfc/digital_dep.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
> index 3982fa084737..ae5407fca12d 100644
> --- a/net/nfc/digital_dep.c
> +++ b/net/nfc/digital_dep.c
> @@ -1117,12 +1117,12 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
>  	pfb = dep_req->pfb;
>
>  	if (DIGITAL_NFC_DEP_DID_BIT_SET(pfb)) {
> -		if (ddev->did && (ddev->did == resp->data[3])) {
> -			size++;
> -		} else {
> +		if (resp->len < size + 1 || !ddev->did ||
> +		    ddev->did != resp->data[size]) {
>  			rc = -EIO;
>  			goto exit;
>  		}
> +		size++;
>  	} else if (ddev->did) {
>  		rc = -EIO;
>  		goto exit;
>
> base-commit: df2908090cda368b01ff43709f51890076c56157

Kind Regards

Aamir A.