Messages in this thread | | | Date | Wed, 2 Mar 2022 10:02:01 +0100 | Subject | Re: [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param | From | Krzysztof Kozlowski <> |
| |
On 02/03/2022 04:33, cgel.zte@gmail.com wrote: > From: "Minghao Chi (CGEL ZTE)" <chi.minghao@zte.com.cn> > > On 64-bit systems, struct nci_set_config_param has > an added padding of 7 bytes between struct members > id and len. Even though all struct members are initialized, > the 7-byte hole will contain data from the kernel stack. > This patch zeroes out struct nci_set_config_param before > usage, preventing infoleaks to userspace. > > v1->v2: > -Modify the title. > -Add explanatory information.
Changelog goes below ---.
> Reported-by: Zeal Robot <zealci@zte.com.cn>
Why do you ignore the comment about missing report?
> Signed-off-by: Minghao Chi (CGEL ZTE) <chi.minghao@zte.com.cn> > --- > net/nfc/nci/core.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c > index d2537383a3e8..32be42be1152 100644 > --- a/net/nfc/nci/core.c > +++ b/net/nfc/nci/core.c > @@ -641,6 +641,7 @@ int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, const __u8 *val) > if (!val || !len) > return 0; > > + memset(¶m, 0x0, sizeof(param));
You ignored the comment here as well. That's not how a v2 should be sent... if you don't agree with comments, we need to keep discussing.
> param.id = id; > param.len = len; > param.val = val;
Best regards, Krzysztof
| |