[PATCH] nfc: digital: clamp sensf_res memcpy to NFC_SENSF_RES_MAXSIZE

digital_in_recv_sensf_res() copies resp->len bytes from a remote
NFC-F device response into target.sensf_res without checking that
the length fits in the 18-byte destination buffer
(NFC_SENSF_RES_MAXSIZE).

A nearby malicious NFC-F device can send an oversized SENSF_RES
response to overflow the stack-local struct nfc_target, potentially
overwriting saved registers and the return address.

Fix by clamping the copy length to NFC_SENSF_RES_MAXSIZE.

Found by pwnkit (https://github.com/0sec-labs/pwnkit), an automated
kernel source review tool by 0sec (https://0sec.ai).

Signed-off-by: Doruk Tan Ozturk <[email protected]>
---
 net/nfc/digital_technology.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -778,6 +778,8 @@ static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev,
 
 	sensf_res = resp->data;
+	if (resp->len > NFC_SENSF_RES_MAXSIZE)
+		resp->len = NFC_SENSF_RES_MAXSIZE;
 	memcpy(target.sensf_res, sensf_res, resp->len);