Re: [PATCH v2] nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

[David Heidelberg]

On 12/09/2026 06:03, Deepanshu Kartikey wrote:
> frame->ccid.datalen is read directly from the USB response frame
> and used, unchecked, as an index into frame->data[]. A malicious or
> malfunctioning device can set this field to an arbitrary value,
> causing the driver to read far outside the received buffer.
>
> Bound ccid.datalen against the maximum possible ACR122 frame size
> before using it. This replaces the existing datalen == 0 check,
> since datalen < 2 already covers that case and additionally
> rejects datalen == 1, which would still underflow the
> "datalen - 2" offset used below.
>
> Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation")
> Reported-by: syzbot+1853daab1a47603d4678@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1853daab1a47603d4678
> Tested-by: syzbot+1853daab1a47603d4678@xxxxxxxxxxxxxxxxxxxxxxxxx
> Assisted-by: Claude (Anthropic)

Hello Deepanshu,

thank you for the patch, could you please correct the Assisted-by tag?

See: https://docs.kernel.org/process/coding-assistants.html

Thanks
David

> Link: https://lore.kernel.org/all/20260906054336.20187-1-kartikey406@xxxxxxxxx/T/ [v1]
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
>
> ---
> Changes in v2:
> - Replace the existing "if (!frame->ccid.datalen)" check instead of
>    adding the new bounds check alongside it, since the new check
>    already subsumes it (per Johan Hovold).
> ---
>   drivers/nfc/pn533/usb.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)