From: Ryosuke Yasuoka <ryasuoka@redhat.com>
To: krzk@kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com
Cc: Ryosuke Yasuoka <ryasuoka@redhat.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
syoshida@redhat.com,
syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com
Subject: [PATCH net v2] nfc: nci: Fix uninit-value in nci_rx_work
Date: Sat, 27 Apr 2024 19:35:54 +0900 [thread overview]
Message-ID: <20240427103558.161706-1-ryasuoka@redhat.com> (raw)
syzbot reported the following uninit-value access issue [1]
nci_rx_work() parses received packet from ndev->rx_q. It should be
validated header size, payload size and total packet size before
processing the packet. If an invalid packet is detected, it should be
silently discarded.
Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
Reported-and-tested-by: syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7b4dc6cd50410152534 [1]
Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
---
v2
- The v1 patch only checked whether skb->len is zero. This patch also
checks header size, payload size and total packet size.
v1
https://lore.kernel.org/linux-kernel/CANn89iJrQevxPFLCj2P=U+XSisYD0jqrUQpa=zWMXTjj5+RriA@mail.gmail.com/T/
net/nfc/nci/core.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 0d26c8ec9993..ab07b5f69664 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1463,6 +1463,16 @@ int nci_core_ntf_packet(struct nci_dev *ndev, __u16 opcode,
ndev->ops->n_core_ops);
}
+static bool nci_valid_size(struct sk_buff *skb, unsigned int header_size)
+{
+ if (skb->len < header_size ||
+ !nci_plen(skb->data) ||
+ skb->len < header_size + nci_plen(skb->data)) {
+ return false;
+ }
+ return true;
+}
+
/* ---- NCI TX Data worker thread ---- */
static void nci_tx_work(struct work_struct *work)
@@ -1516,30 +1526,36 @@ static void nci_rx_work(struct work_struct *work)
nfc_send_to_raw_sock(ndev->nfc_dev, skb,
RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
- if (!nci_plen(skb->data)) {
- kfree_skb(skb);
- break;
- }
+ if (!skb->len)
+ goto invalid_pkt_free;
/* Process frame */
switch (nci_mt(skb->data)) {
case NCI_MT_RSP_PKT:
+ if (!nci_valid_size(skb, NCI_CTRL_HDR_SIZE))
+ goto invalid_pkt_free;
nci_rsp_packet(ndev, skb);
break;
case NCI_MT_NTF_PKT:
+ if (!nci_valid_size(skb, NCI_CTRL_HDR_SIZE))
+ goto invalid_pkt_free;
nci_ntf_packet(ndev, skb);
break;
case NCI_MT_DATA_PKT:
+ if (!nci_valid_size(skb, NCI_DATA_HDR_SIZE))
+ goto invalid_pkt_free;
nci_rx_data_packet(ndev, skb);
break;
default:
pr_err("unknown MT 0x%x\n", nci_mt(skb->data));
- kfree_skb(skb);
- break;
+ goto invalid_pkt_free;
}
+invalid_pkt_free:
+ kfree_skb(skb);
+ break;
}
/* check if a data exchange timeout has occurred */
--
2.44.0
next reply other threads:[~2024-04-27 10:36 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-27 10:35 Ryosuke Yasuoka [this message]
2024-04-28 13:45 ` [PATCH net v2] nfc: nci: Fix uninit-value in nci_rx_work Simon Horman
2024-04-29 14:30 ` Ryosuke Yasuoka
2024-04-29 16:41 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240427103558.161706-1-ryasuoka@redhat.com \
--to=ryasuoka@redhat.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=krzk@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syoshida@redhat.com \
--cc=syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.