Ryosuke Yasuoka 8948e30de8 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet ... [ Upstream commit d24b03535e ] syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes. Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+7ea9413ea6749baf5574@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+29b5ca705d2e0f4a44d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7ea9413ea6749baf5574 [1] Closes: https://syzkaller.appspot.com/bug?extid=29b5ca705d2e0f4a44d2 [2] Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Reviewed-by: Jeremy Cline <jeremy@jcline.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-10 16:37:54 +02:00
..
hci	NFC: hci: Split memcpy() of struct hcp_message flexible array	2022-09-27 07:45:18 -07:00
nci	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:37:54 +02:00
Kconfig	…
Makefile	…
af_nfc.c	nfc: fix error handling of nfc_proto_register()	2021-10-13 17:32:38 -07:00
core.c	net: nfc: Directly use ida_alloc()/free()	2022-05-28 15:28:47 +01:00
digital.h	…
digital_core.c	net: fill in MODULE_DESCRIPTION()s for NFC	2024-01-11 16:16:08 -08:00
digital_dep.c	…
digital_technology.c	NFC: digital: fix possible memory leak in digital_in_send_sdd_req()	2021-10-13 17:44:29 -07:00
llcp.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-06-26 10:57:23 +01:00
llcp_commands.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
llcp_core.c	nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local	2023-12-25 07:29:04 +00:00
llcp_sock.c	nfc: Do not send datagram if socket state isn't LLCP_BOUND	2023-12-25 07:29:04 +00:00
netlink.c	genetlink: use attrs from struct genl_info	2023-08-15 15:00:45 -07:00
nfc.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-06-26 10:57:23 +01:00
rawsock.c	nfc: Add KCOV annotations	2022-11-02 11:58:13 +00:00