diff options
| author | Kees Cook <keescook@chromium.org> | 2022-12-02 13:44:14 -0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-12-05 17:46:25 -0800 |
| commit | e329e71013c9b5a4535b099208493c7826ee4a64 (patch) | |
| tree | 91dec2e30e570557d62c12ef81ef7efadb8d2971 /drivers/net/wwan/iosm/iosm_ipc_mux.c | |
| parent | e8b4fc13900b8e8be48debffd0dfd391772501f7 (diff) | |
NFC: nci: Bounds check struct nfc_target arrays
While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:
memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)
This appears to be a legitimate lack of bounds checking in
nci_add_new_protocol(). Add the missing checks.
Reported-by: syzbot+210e196cef4711b65139@syzkaller.appspotmail.com
Link: https://lore.kernel.org/lkml/0000000000001c590f05ee7b3ff4@google.com
Fixes: 019c4fbaa790 ("NFC: Add NCI multiple targets support")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20221202214410.never.693-kees@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/wwan/iosm/iosm_ipc_mux.c')
0 files changed, 0 insertions, 0 deletions