Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

From: Suren Baghdasaryan <surenb@google.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: security@kernel.org, Kevin Deus <kdeus@google.com>,
	Samuel Ortiz <sameo@linux.intel.com>,
	"David S. Miller" <davem@davemloft.net>,
	Allen Pais <allen.pais@oracle.com>,
	Kees Cook <keescook@chromium.org>,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
Date: Tue, 14 Aug 2018 13:26:04 -0700	[thread overview]
Message-ID: <CAJuCfpHSZuabLr6+t_n7UDamJCAP6EPTNEZ6kNqWOhk2mpYADg@mail.gmail.com> (raw)
In-Reply-To: <CAJuCfpF0Y6wc1z-rbn2wdWROgc_FkD2EX5HzDMcZ1oB5Z=dXSw@mail.gmail.com>

On Tue, Aug 14, 2018 at 9:57 AM, Suren Baghdasaryan <surenb@google.com> wrote:
> On Tue, Aug 14, 2018 at 2:54 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>> Thanks.  This is great.  I'm so glad these are finally getting fixed.
>>
>> Do we need to fix nfc_hci_msg_rx_work() and nfc_hci_recv_from_llc() as
>> well?  In nfc_hci_recv_from_llc() we allow pipe to be NFC_HCI_FRAGMENT
>> (0x7f) so that's one element beyond the end of the array and the
>> NFC_HCI_HCP_RESPONSE isn't checked.
>>
>> Also nci_hci_msg_rx_work() and nci_hci_data_received_cb() use
>> NCI_HCP_MSG_GET_PIPE() so those could be off by one.
>
> Good point. From hci.h:
>
> /*
>  * According to specification 102 622 chapter 4.4 Pipes,
>  * the pipe identifier is 7 bits long.
>  */
> #define NFC_HCI_MAX_PIPES 127
>
> And then:
>
> struct nfc_hci_dev {
>   ...
>   struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES];
>   ...
> }
>
> I think the correct fix would be to change it to:
>
>   struct nfc_hci_pipe pipes[NFC_HCI_MAX_PIPES + 1];
>
> What do you think?
>

Just to be clear, this would fix the problem Dan described in his
reply and it should be implemented in a separate patch. The original
fix is still valid.

>>
>> regards,
>> dan carpenter
>>