Suren Baghdasaryan ec56e98f80 NFC: Fix possible memory corruption when handling SHDLC I-Frame commands ... commit 674d9de02a upstream. When handling SHDLC I-Frame commands "pipe" field used for indexing into an array should be checked before usage. If left unchecked it might access memory outside of the array of size NFC_HCI_MAX_PIPES(127). Malformed NFC HCI frames could be injected by a malicious NFC device communicating with the device being attacked (remote attack vector), or even by an attacker with physical access to the I2C bus such that they could influence the data transfers on that bus (local attack vector). skb->data is controlled by the attacker and has only been sanitized in the most trivial ways (CRC check), therefore we can consider the create_info struct and all of its members to tainted. 'create_info->pipe' with max value of 255 (uint8) is used to take an offset of the hdev->pipes array of 127 elements which can lead to OOB write. Cc: Samuel Ortiz <sameo@linux.intel.com> Cc: Allen Pais <allen.pais@oracle.com> Cc: "David S. Miller" <davem@davemloft.net> Suggested-by: Kevin Deus <kdeus@google.com> Signed-off-by: Suren Baghdasaryan <surenb@google.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-29 03:08:51 -07:00
..
hci	NFC: Fix possible memory corruption when handling SHDLC I-Frame commands	2018-09-29 03:08:51 -07:00
nci	NFC: fix broken device allocation	2017-07-27 15:06:03 -07:00
af_nfc.c	net: Pass kern from net_proto_family.create to sk_alloc	2015-05-11 10:50:17 -04:00
core.c	NFC: fix device-allocation error return	2017-11-30 08:37:23 +00:00
digital_core.c	NFC: netlink: Add mode parameter to deactivate_target functions	2015-10-27 03:55:12 +01:00
digital_dep.c	NFC: digital: Add NFC-DEP Target-side ATN Support	2014-11-28 12:40:38 +01:00
digital_technology.c	NFC: digital: Add 'tg_listen_md' and 'tg_get_rf_tech' driver hooks	2014-07-23 01:17:31 +02:00
digital.h	NFC: digital: Add 'tg_listen_md' and 'tg_get_rf_tech' driver hooks	2014-07-23 01:17:31 +02:00
Kconfig	NFC Digital: Add NFC-F technology support	2013-09-25 02:02:25 +02:00
llcp_commands.c	net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL.	2018-07-22 14:25:54 +02:00
llcp_core.c	net: Pass kern from net_proto_family.create to sk_alloc	2015-05-11 10:50:17 -04:00
llcp_sock.c	NFC: Add sockaddr length checks before accessing sa_family in bind handlers	2017-07-27 15:06:03 -07:00
llcp.h	net: Pass kern from net_proto_family.create to sk_alloc	2015-05-11 10:50:17 -04:00
Makefile	NFC Digital: Add initiator NFC-DEP support	2013-09-25 02:02:27 +02:00
netlink.c	NFC: llcp: Limit size of SDP URI	2018-05-30 07:48:59 +02:00
nfc.h	NFC: netlink: Add mode parameter to deactivate_target functions	2015-10-27 03:55:12 +01:00
rawsock.c	NFC: netlink: Add mode parameter to deactivate_target functions	2015-10-27 03:55:12 +01:00