Ryosuke Yasuoka d24b03535e nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet ... syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes. Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+7ea9413ea6749baf5574@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+29b5ca705d2e0f4a44d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7ea9413ea6749baf5574 [1] Closes: https://syzkaller.appspot.com/bug?extid=29b5ca705d2e0f4a44d2 [2] Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Reviewed-by: Jeremy Cline <jeremy@jcline.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2024-03-22 09:41:39 +00:00
..
core.c	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-03-22 09:41:39 +00:00
data.c	NFC: nci: fix memory leak in nci_rx_data_packet()	2022-11-22 12:42:23 +01:00
hci.c	nfc: Add KCOV annotations	2022-11-02 11:58:13 +00:00
Kconfig
lib.c
Makefile
ntf.c	NFC: nci: Bounds check struct nfc_target arrays	2022-12-05 17:46:25 -08:00
rsp.c	nfc: nci: fix the UAF of rf_conn_info object	2021-10-08 17:24:32 +01:00
spi.c	net: fill in MODULE_DESCRIPTION()s for NFC	2024-01-11 16:16:08 -08:00
uart.c	tty: ldops: unify to u8	2023-08-11 21:12:47 +02:00