kernel_optimize_test/net/nfc
Suren Baghdasaryan 674d9de02a NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
When handling SHDLC I-Frame commands "pipe" field used for indexing
into an array should be checked before usage. If left unchecked it
might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).

Malformed NFC HCI frames could be injected by a malicious NFC device
communicating with the device being attacked (remote attack vector),
or even by an attacker with physical access to the I2C bus such that
they could influence the data transfers on that bus (local attack vector).
skb->data is controlled by the attacker and has only been sanitized in
the most trivial ways (CRC check), therefore we can consider the
create_info struct and all of its members to tainted. 'create_info->pipe'
with max value of 255 (uint8) is used to take an offset of the
hdev->pipes array of 127 elements which can lead to OOB write.

Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: Allen Pais <allen.pais@oracle.com>
Cc: "David S. Miller" <davem@davemloft.net>
Suggested-by: Kevin Deus <kdeus@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-09-18 19:55:01 -07:00
..
hci NFC: Fix possible memory corruption when handling SHDLC I-Frame commands 2018-09-18 19:55:01 -07:00
nci net: annotate ->poll() instances 2017-11-27 16:20:04 -05:00
af_nfc.c net: socket: mark socket protocol handler structs as const 2017-05-16 11:54:07 -04:00
core.c NFC: Convert timers to use timer_setup() 2017-11-06 01:12:10 +01:00
digital_core.c NFC: digital: Abort cmd when deactivating target 2017-11-10 00:03:39 +01:00
digital_dep.c NFC: digital: NFC-DEP Target WT(nfcdep,max) is now 14 2017-06-23 00:19:59 +02:00
digital_technology.c NFC: digital: NFC-A SEL_RES must be one byte 2017-06-23 00:19:59 +02:00
digital.h NFC: digital: Add 'tg_listen_md' and 'tg_get_rf_tech' driver hooks 2014-07-23 01:17:31 +02:00
Kconfig NFC Digital: Add NFC-F technology support 2013-09-25 02:02:25 +02:00
llcp_commands.c net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. 2018-07-18 10:51:45 -07:00
llcp_core.c NFC: Convert timers to use timer_setup() 2017-11-06 01:12:10 +01:00
llcp_sock.c net: simplify sock_poll_wait 2018-07-30 09:10:25 -07:00
llcp.h net: Pass kern from net_proto_family.create to sk_alloc 2015-05-11 10:50:17 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
netlink.c net: remove unnecessary genlmsg_cancel() calls 2018-05-29 09:53:38 -04:00
nfc.h nfc: netlink: HCI event connectivity implementation 2015-12-29 19:06:20 +01:00
rawsock.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00