Messages in this thread | | | Date | Mon, 27 Nov 2023 11:10:51 +0100 | Subject | Re: [PATCH 1/4] nfc: Extract nfc_dev access from nfc_alloc_send_skb() into the callers | From | Krzysztof Kozlowski <> |
| |
On 25/11/2023 21:26, Siddh Raman Pant wrote: > The only reason why nfc_dev was accessed inside nfc_alloc_send_skb() is > for getting the headroom and tailroom values. > > This can cause UAF to be reported from nfc_alloc_send_skb(), but the > callers are responsible for managing the device access, and thus the > UAF being reported, as the callers (like nfc_llcp_send_ui_frame()) may > repeatedly call this function, and this function will repeatedly try > to get the same headroom and tailroom values.
I don't understand this sentence.
"This can cause ..., but ...". But starts another clause which should be in contradictory to previous one.
> > Thus, put the nfc_dev access responsibility on the callers and accept > the headroom and tailroom values directly.
Is this a fix or improvement? If fix, is the UAF real? If so, you miss Fixes tag.
Best regards, Krzysztof
| |