lkml.org 
[lkml]   [2020]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 14/89] net: nfc: fix bounds checking bugs on "pipe"
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit a3aefbfe45751bf7b338c181b97608e276b5bb73 ]

    This is similar to commit 674d9de02aa7 ("NFC: Fix possible memory
    corruption when handling SHDLC I-Frame commands") and commit d7ee81ad09f0
    ("NFC: nci: Add some bounds checking in nci_hci_cmd_received()") which
    added range checks on "pipe".

    The "pipe" variable comes skb->data[0] in nfc_hci_msg_rx_work().
    It's in the 0-255 range. We're using it as the array index into the
    hdev->pipes[] array which has NFC_HCI_MAX_PIPES (128) members.

    Fixes: 118278f20aa8 ("NFC: hci: Add pipes table to reference them with a tuple {gate, host}")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/nfc/hci/core.c | 19 ++++++++++++++++---
    1 file changed, 16 insertions(+), 3 deletions(-)

    --- a/net/nfc/hci/core.c
    +++ b/net/nfc/hci/core.c
    @@ -193,13 +193,20 @@ exit:
    void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
    struct sk_buff *skb)
    {
    - u8 gate = hdev->pipes[pipe].gate;
    u8 status = NFC_HCI_ANY_OK;
    struct hci_create_pipe_resp *create_info;
    struct hci_delete_pipe_noti *delete_info;
    struct hci_all_pipe_cleared_noti *cleared_info;
    + u8 gate;

    - pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd);
    + pr_debug("from pipe %x cmd %x\n", pipe, cmd);
    +
    + if (pipe >= NFC_HCI_MAX_PIPES) {
    + status = NFC_HCI_ANY_E_NOK;
    + goto exit;
    + }
    +
    + gate = hdev->pipes[pipe].gate;

    switch (cmd) {
    case NFC_HCI_ADM_NOTIFY_PIPE_CREATED:
    @@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_h
    struct sk_buff *skb)
    {
    int r = 0;
    - u8 gate = hdev->pipes[pipe].gate;
    + u8 gate;
    +
    + if (pipe >= NFC_HCI_MAX_PIPES) {
    + pr_err("Discarded event %x to invalid pipe %x\n", event, pipe);
    + goto exit;
    + }

    + gate = hdev->pipes[pipe].gate;
    if (gate == NFC_HCI_INVALID_GATE) {
    pr_err("Discarded event %x to unopened pipe %x\n", event, pipe);
    goto exit;

    \
     
     \ /
      Last update: 2020-03-17 12:23    [W:2.175 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site