netdev - Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpF0Y6wc1z-rbn2wdWROgc_FkD2EX5HzDMcZ1oB5Z=dXSw@mail.gmail.com>
Date:   Tue, 14 Aug 2018 09:57:27 -0700
From:   Suren Baghdasaryan <surenb@...gle.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     security@...nel.org, Kevin Deus <kdeus@...gle.com>,
        Samuel Ortiz <sameo@...ux.intel.com>,
        "David S. Miller" <davem@...emloft.net>,
        Allen Pais <allen.pais@...cle.com>,
        Kees Cook <keescook@...omium.org>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling
 SHDLC I-Frame commands

On Tue, Aug 14, 2018 at 2:54 AM, Dan Carpenter <dan.carpenter@...cle.com> wrote:
> Thanks.  This is great.  I'm so glad these are finally getting fixed.
>
> Do we need to fix nfc_hci_msg_rx_work() and nfc_hci_recv_from_llc() as
> well?  In nfc_hci_recv_from_llc() we allow pipe to be NFC_HCI_FRAGMENT
> (0x7f) so that's one element beyond the end of the array and the
> NFC_HCI_HCP_RESPONSE isn't checked.
>
> Also nci_hci_msg_rx_work() and nci_hci_data_received_cb() use
> NCI_HCP_MSG_GET_PIPE() so those could be off by one.

Good point. From hci.h:

/*
 * According to specification 102 622 chapter 4.4 Pipes,
 * the pipe identifier is 7 bits long.
 */
#define NFC_HCI_MAX_PIPES 127

And then:

struct nfc_hci_dev {
  ...
  struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES];
  ...
}

I think the correct fix would be to change it to:

  struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES + 1];

What do you think?

>
> regards,
> dan carpenter
>