Skip to content

Commit 54e8d5c

Browse files
YsuOSsfX-bot
authored andcommitted
nfc: nci: Fix uninit-value in nci_rx_work
[ Upstream commit e4a87abf588536d1cdfb128595e6e680af5cf3ed ] syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded. Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") Reported-and-tested-by: syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7b4dc6cd50410152534 [1] Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 406cfac9debd4a6d3dc5d9258ee086372a8c08b6) Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
1 parent dcbb2ee commit 54e8d5c

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

net/nfc/nci/core.c

+14-1
Original file line numberDiff line numberDiff line change
@@ -1459,6 +1459,19 @@ int nci_core_ntf_packet(struct nci_dev *ndev, __u16 opcode,
14591459
ndev->ops->n_core_ops);
14601460
}
14611461

1462+
static bool nci_valid_size(struct sk_buff *skb)
1463+
{
1464+
unsigned int hdr_size = NCI_CTRL_HDR_SIZE;
1465+
BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE);
1466+
1467+
if (skb->len < hdr_size ||
1468+
!nci_plen(skb->data) ||
1469+
skb->len < hdr_size + nci_plen(skb->data)) {
1470+
return false;
1471+
}
1472+
return true;
1473+
}
1474+
14621475
/* ---- NCI TX Data worker thread ---- */
14631476

14641477
static void nci_tx_work(struct work_struct *work)
@@ -1509,7 +1522,7 @@ static void nci_rx_work(struct work_struct *work)
15091522
nfc_send_to_raw_sock(ndev->nfc_dev, skb,
15101523
RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
15111524

1512-
if (!nci_plen(skb->data)) {
1525+
if (!nci_valid_size(skb)) {
15131526
kfree_skb(skb);
15141527
break;
15151528
}

0 commit comments

Comments
 (0)