Messages in this thread | | | Date | Thu, 9 May 2024 16:39:25 +0200 | Subject | Re: [PATCH net v4] nfc: nci: Fix uninit-value in nci_rx_work | From | Krzysztof Kozlowski <> |
| |
On 09/05/2024 13:30, Ryosuke Yasuoka wrote: > syzbot reported the following uninit-value access issue [1] > > nci_rx_work() parses received packet from ndev->rx_q. It should be > validated header size, payload size and total packet size before > processing the packet. If an invalid packet is detected, it should be > silently discarded. > > Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") > Reported-and-tested-by: syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=d7b4dc6cd50410152534 [1] > Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> > --- > v4 > - v3 patch uses goto statement and it makes codes complicated. So this > patch simply calls kfree_skb inside loop and remove goto statement. > - [2] inserted kcov_remote_stop() to fix kcov check. However, as we > discuss about my v3 patch [3], it should not exit the for statement > and should continue processing subsequent packets. This patch removes
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Best regards, Krzysztof
| |