lkml.org 
[lkml]   [2023]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/4] nfc: Extract nfc_dev access from nfc_alloc_send_skb() into the callers
From
On 25/11/2023 21:26, Siddh Raman Pant wrote:
> The only reason why nfc_dev was accessed inside nfc_alloc_send_skb() is
> for getting the headroom and tailroom values.
>
> This can cause UAF to be reported from nfc_alloc_send_skb(), but the
> callers are responsible for managing the device access, and thus the
> UAF being reported, as the callers (like nfc_llcp_send_ui_frame()) may
> repeatedly call this function, and this function will repeatedly try
> to get the same headroom and tailroom values.

I don't understand this sentence.

"This can cause ..., but ...". But starts another clause which should be
in contradictory to previous one.

>
> Thus, put the nfc_dev access responsibility on the callers and accept
> the headroom and tailroom values directly.

Is this a fix or improvement? If fix, is the UAF real? If so, you miss
Fixes tag.


Best regards,
Krzysztof

\
 
 \ /
  Last update: 2023-11-27 11:13    [W:0.130 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site