Ryosuke Yasuoka b51ec7fc9f nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet ... [ Upstream commit d24b03535e ] syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes. Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+7ea9413ea6749baf5574@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+29b5ca705d2e0f4a44d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7ea9413ea6749baf5574 [1] Closes: https://syzkaller.appspot.com/bug?extid=29b5ca705d2e0f4a44d2 [2] Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Reviewed-by: Jeremy Cline <jeremy@jcline.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-10 16:28:21 +02:00
..
hci	NFC: hci: Split memcpy() of struct hcp_message flexible array	2022-09-27 07:45:18 -07:00
nci	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:28:21 +02:00
Kconfig	…
Makefile	…
af_nfc.c	…
core.c	net: nfc: Directly use ida_alloc()/free()	2022-05-28 15:28:47 +01:00
digital.h	…
digital_core.c	…
digital_dep.c	…
digital_technology.c	…
llcp.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
llcp_commands.c	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
llcp_core.c	nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local	2024-01-10 17:10:22 +01:00
llcp_sock.c	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
netlink.c	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
nfc.h	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
rawsock.c	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00