digital_tg_recv_sens_req() reads resp->data[0] into sens_req at line 1092 before the !resp->len guard fires at line 1094. A zero-length frame causes an unconditional 1-byte out-of-bounds read before any length check has taken place. The root cause is that the assignment and the length check are split across two statements: resp->data[0] is read unconditionally into sens_req, and only then is resp->len tested as part of a compound condition. Even though the || operator correctly short-circuits, the read on the previous line is already done. Move the length guard before the data access by splitting the combined condition into an early resp->len check followed by the data read and the command comparison. Fixes: 2e7a3e7ee80d ("NFC Digital: Add target mode for NFC-A/ISO14443A") Cc: stable@vger.kernel.org Signed-off-by: Lekë Hapçiu --- net/nfc/digital_technology.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c index XXXXXXX..XXXXXXX 100644 --- a/net/nfc/digital_technology.c +++ b/net/nfc/digital_technology.c @@ -1090,11 +1090,14 @@ void digital_tg_recv_sens_req(struct nfc_digital_dev *ddev, void *arg, } - sens_req = resp->data[0]; - - if (!resp->len || (sens_req != DIGITAL_CMD_SENS_REQ && - sens_req != DIGITAL_CMD_ALL_REQ)) { + if (!resp->len) { rc = -EINVAL; goto exit; } + + sens_req = resp->data[0]; + if (sens_req != DIGITAL_CMD_SENS_REQ && sens_req != DIGITAL_CMD_ALL_REQ) { + rc = -EINVAL; + goto exit; + } rc = digital_tg_send_sens_res(ddev); -- 2.34.1