Re: [PATCH] nfc: digital: clamp sensf_res memcpy to NFC_SENSF_RES_MAXSIZE

From: Doruk Tan Ozturk <[email protected]>
Date: Tue, 26 May 2026 11:31:12 +0200

> [PATCH] nfc: digital: clamp sensf_res memcpy to NFC_SENSF_RES_MAXSIZE

This should be marked as "PATCH net-next" or "PATCH net". This is a fix
I believe, so most likely the latter.

> digital_in_recv_sensf_res() copies resp->len bytes from a remote
> NFC-F device response into target.sensf_res without checking that
> the length fits in the 18-byte destination buffer
> (NFC_SENSF_RES_MAXSIZE).
> 
> A nearby malicious NFC-F device can send an oversized SENSF_RES
> response to overflow the stack-local struct nfc_target, potentially
> overwriting saved registers and the return address.
> 
> Fix by clamping the copy length to NFC_SENSF_RES_MAXSIZE.
> 
> Found by pwnkit (https://github.com/0sec-labs/pwnkit), an automated
> kernel source review tool by 0sec (https://0sec.ai).

If this is a fix, it should contain a "Fixes:" tag pointing to the
commit which introduced this vulnerability.

If the original commit landed a long ago, you might want to add
"Cc: [email protected]" to mark it as a candidate for backporting
to the LTSes.

> 
> Signed-off-by: Doruk Tan Ozturk <[email protected]>
> ---
>  net/nfc/digital_technology.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
> --- a/net/nfc/digital_technology.c
> +++ b/net/nfc/digital_technology.c
> @@ -778,6 +778,8 @@ static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev,
>  
>  	sensf_res = resp->data;
> +	if (resp->len > NFC_SENSF_RES_MAXSIZE)
> +		resp->len = NFC_SENSF_RES_MAXSIZE;

Alternatively:

	resp->len = min(resp->len, NFC_SENSF_RES_MAXSIZE);

A matter of taste anyway.

You can also leave a comment above this line saying that it's necessary
to validate the value and make sure it doesn't overflow.

>  	memcpy(target.sensf_res, sensf_res, resp->len);

Thanks,
Olek