mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 04:38:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
a0c9fd22e3
linux/drivers/nfc
History
Aleksandr Mishin febccb3925 nfc: pn533: Add poll mod list filling check 
In case of im_protocols value is 1 and tm_protocols value is 0 this
combination successfully passes the check
'if (!im_protocols && !tm_protocols)' in the nfc_start_poll().
But then after pn533_poll_create_mod_list() call in pn533_start_poll()
poll mod list will remain empty and dev->poll_mod_count will remain 0
which lead to division by zero.

Normally no im protocol has value 1 in the mask, so this combination is
not expected by driver. But these protocol values actually come from
userspace via Netlink interface (NFC_CMD_START_POLL operation). So a
broken or malicious program may pass a message containing a "bad"
combination of protocol parameter values so that dev->poll_mod_count
is not incremented inside pn533_poll_create_mod_list(), thus leading
to division by zero.
Call trace looks like:
nfc_genl_start_poll()
  nfc_start_poll()
    ->start_poll()
    pn533_start_poll()

Add poll mod list filling check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: dfccd0f580 ("NFC: pn533: Add some polling entropy")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-08-29 12:08:44 +02:00
..
fdp
microread nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
nfcmrvl nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
nxp-nci nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
pn533 nfc: pn533: Add poll mod list filling check 2024-08-29 12:08:44 +02:00
pn544 minmax: make generic MIN() and MAX() macros available everywhere 2024-07-28 15:49:18 -07:00
s3fwrn5 nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
st21nfca nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
st95hf
st-nci nfc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-20 19:28:31 -07:00
Kconfig
Makefile
mei_phy.c
mei_phy.h
nfcsim.c
port100.c
trf7970a.c
virtual_ncidev.c