The skb->len != 1 guard admits a 2-byte payload where config_status at offset 2 lies one byte past skb->len. Fix by guarding the nci_ver and config_status accesses with an explicit skb->len >= 3 check, and restoring the original skb->len != 1 condition around nci_req_complete() so the NCI 2.x reset request stays pending until CORE_RESET_NTF arrives. Fixes: bcd684aace34 ("net/nfc/nci: Support NCI 2.x initial sequence") Signed-off-by: Ömer Mete Kaya --- Changes in v2: - Preserve the original skb->len != 1 condition around nci_req_complete() so the NCI 2.x reset request stays pending until CORE_RESET_NTF arrives (reported by sashiko). - Fix NCI version labels in comment (NCI 1.x = 3-byte RSP, NCI 2.x = 1-byte RSP + NTF). net/nfc/nci/rsp.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c index e20df7fa0829..8226d09c99a5 100644 --- a/net/nfc/nci/rsp.c +++ b/net/nfc/nci/rsp.c @@ -32,22 +32,15 @@ static void nci_core_reset_rsp_packet(struct nci_dev *ndev, pr_debug("status 0x%x\n", rsp->status); - /* NCI 2.x reset response carries nci_ver and config_status; - * a 1-byte response is the NCI 1.x status-only form. - * Require at least 3 bytes before reading those fields. - */ - if (skb->len == 1) { - nci_req_complete(ndev, rsp->status); - return; - } - + /* NCI 1.x: 3-byte RSP; NCI 2.x: 1-byte RSP, request completed by NTF. */ if (skb->len >= 3 && rsp->status == NCI_STATUS_OK) { ndev->nci_ver = rsp->nci_ver; pr_debug("nci_ver 0x%x, config_status 0x%x\n", rsp->nci_ver, rsp->config_status); } - nci_req_complete(ndev, rsp->status); + if (skb->len != 1) + nci_req_complete(ndev, rsp->status); } static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev, -- 2.55.0