* [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param
@ 2022-03-02 3:33 cgel.zte
2022-03-02 4:13 ` weiyongjun (A)
2022-03-02 9:02 ` Krzysztof Kozlowski
0 siblings, 2 replies; 3+ messages in thread
From: cgel.zte @ 2022-03-02 3:33 UTC (permalink / raw)
To: krzysztof.kozlowski
Cc: davem, kuba, netdev, linux-kernel, Minghao Chi (CGEL ZTE), Zeal Robot
From: "Minghao Chi (CGEL ZTE)" <chi.minghao@zte.com.cn>
On 64-bit systems, struct nci_set_config_param has
an added padding of 7 bytes between struct members
id and len. Even though all struct members are initialized,
the 7-byte hole will contain data from the kernel stack.
This patch zeroes out struct nci_set_config_param before
usage, preventing infoleaks to userspace.
v1->v2:
-Modify the title.
-Add explanatory information.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Minghao Chi (CGEL ZTE) <chi.minghao@zte.com.cn>
---
net/nfc/nci/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index d2537383a3e8..32be42be1152 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -641,6 +641,7 @@ int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, const __u8 *val)
if (!val || !len)
return 0;
+ memset(¶m, 0x0, sizeof(param));
param.id = id;
param.len = len;
param.val = val;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param
2022-03-02 3:33 [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param cgel.zte
@ 2022-03-02 4:13 ` weiyongjun (A)
2022-03-02 9:02 ` Krzysztof Kozlowski
1 sibling, 0 replies; 3+ messages in thread
From: weiyongjun (A) @ 2022-03-02 4:13 UTC (permalink / raw)
To: cgel.zte, krzysztof.kozlowski
Cc: davem, kuba, netdev, linux-kernel, Minghao Chi (CGEL ZTE), Zeal Robot
> From: "Minghao Chi (CGEL ZTE)" <chi.minghao@zte.com.cn>
>
> On 64-bit systems, struct nci_set_config_param has
> an added padding of 7 bytes between struct members
> id and len. Even though all struct members are initialized,
> the 7-byte hole will contain data from the kernel stack.
> This patch zeroes out struct nci_set_config_param before
> usage, preventing infoleaks to userspace.
How this info leaks to userspace?
nci_set_config_req() convert to use packed 'struct nci_core_set_config_cmd'
to send data, which does not contain hole.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param
2022-03-02 3:33 [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param cgel.zte
2022-03-02 4:13 ` weiyongjun (A)
@ 2022-03-02 9:02 ` Krzysztof Kozlowski
1 sibling, 0 replies; 3+ messages in thread
From: Krzysztof Kozlowski @ 2022-03-02 9:02 UTC (permalink / raw)
To: cgel.zte
Cc: davem, kuba, netdev, linux-kernel, Minghao Chi (CGEL ZTE), Zeal Robot
On 02/03/2022 04:33, cgel.zte@gmail.com wrote:
> From: "Minghao Chi (CGEL ZTE)" <chi.minghao@zte.com.cn>
>
> On 64-bit systems, struct nci_set_config_param has
> an added padding of 7 bytes between struct members
> id and len. Even though all struct members are initialized,
> the 7-byte hole will contain data from the kernel stack.
> This patch zeroes out struct nci_set_config_param before
> usage, preventing infoleaks to userspace.
>
> v1->v2:
> -Modify the title.
> -Add explanatory information.
Changelog goes below ---.
> Reported-by: Zeal Robot <zealci@zte.com.cn>
Why do you ignore the comment about missing report?
> Signed-off-by: Minghao Chi (CGEL ZTE) <chi.minghao@zte.com.cn>
> ---
> net/nfc/nci/core.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
> index d2537383a3e8..32be42be1152 100644
> --- a/net/nfc/nci/core.c
> +++ b/net/nfc/nci/core.c
> @@ -641,6 +641,7 @@ int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, const __u8 *val)
> if (!val || !len)
> return 0;
>
> + memset(¶m, 0x0, sizeof(param));
You ignored the comment here as well. That's not how a v2 should be
sent... if you don't agree with comments, we need to keep discussing.
> param.id = id;
> param.len = len;
> param.val = val;
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-02 9:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-02 3:33 [PATCH V2] net/nfc/nci: fix infoleak in struct nci_set_config_param cgel.zte
2022-03-02 4:13 ` weiyongjun (A)
2022-03-02 9:02 ` Krzysztof Kozlowski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.