[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <13e55ef1-24fd-6b78-8b67-792c7452fe79@linaro.org>
Date: Wed, 14 Dec 2022 14:14:09 +0100
From: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To: Minsuk Kang <linuxlovemin@...sei.ac.kr>, netdev@...r.kernel.org
Cc: linma@....edu.cn, davem@...emloft.net, sameo@...ux.intel.com,
linville@...driver.com, dokyungs@...sei.ac.kr,
jisoo.jang@...sei.ac.kr
Subject: Re: [PATCH net v3] nfc: pn533: Clear nfc_target before being used
On 14/12/2022 02:51, Minsuk Kang wrote:
> Fix a slab-out-of-bounds read that occurs in nla_put() called from
> nfc_genl_send_target() when target->sensb_res_len, which is duplicated
> from an nfc_target in pn533, is too large as the nfc_target is not
> properly initialized and retains garbage values. Clear nfc_targets with
> memset() before they are used.
>
> Found by a modified version of syzkaller.
>
> BUG: KASAN: slab-out-of-bounds in nla_put
> Call Trace:
> memcpy
> nla_put
> nfc_genl_dump_targets
> genl_lock_dumpit
> netlink_dump
> __netlink_dump_start
> genl_family_rcv_msg_dumpit
> genl_rcv_msg
> netlink_rcv_skb
> genl_rcv
> netlink_unicast
> netlink_sendmsg
> sock_sendmsg
> ____sys_sendmsg
> ___sys_sendmsg
> __sys_sendmsg
> do_syscall_64
>
> Fixes: 673088fb42d0 ("NFC: pn533: Send ATR_REQ directly for active device detection")
> Fixes: 361f3cb7f9cf ("NFC: DEP link hook implementation for pn533")
> Signed-off-by: Minsuk Kang <linuxlovemin@...sei.ac.kr>
> ---
> v2->v3:
> Remove an inappropriate tag
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
Best regards,
Krzysztof
Powered by blists - more mailing lists