[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ae2aae77-c194-4924-b698-4a499eabec5d@linaro.org>
Date: Mon, 27 Nov 2023 11:10:51 +0100
From: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To: Siddh Raman Pant <code@...dh.me>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] nfc: Extract nfc_dev access from nfc_alloc_send_skb()
into the callers
On 25/11/2023 21:26, Siddh Raman Pant wrote:
> The only reason why nfc_dev was accessed inside nfc_alloc_send_skb() is
> for getting the headroom and tailroom values.
>
> This can cause UAF to be reported from nfc_alloc_send_skb(), but the
> callers are responsible for managing the device access, and thus the
> UAF being reported, as the callers (like nfc_llcp_send_ui_frame()) may
> repeatedly call this function, and this function will repeatedly try
> to get the same headroom and tailroom values.
I don't understand this sentence.
"This can cause ..., but ...". But starts another clause which should be
in contradictory to previous one.
>
> Thus, put the nfc_dev access responsibility on the callers and accept
> the headroom and tailroom values directly.
Is this a fix or improvement? If fix, is the UAF real? If so, you miss
Fixes tag.
Best regards,
Krzysztof
Powered by blists - more mailing lists