From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
To: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>,
netdev@vger.kernel.org
Cc: linma@zju.edu.cn, davem@davemloft.net, sameo@linux.intel.com,
linville@tuxdriver.com, dokyungs@yonsei.ac.kr,
jisoo.jang@yonsei.ac.kr, Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Subject: Re: Re: [PATCH net v2] nfc: pn533: Clear nfc_target before being used
Date: Wed, 14 Dec 2022 01:03:58 +0900 [thread overview]
Message-ID: <20221213160358.GA109198@medve-MS-7D32> (raw)
In-Reply-To: <cd3a1383-9d6a-19ad-fd6e-c45da7e646b4@linaro.org>
On Tue, Dec 13, 2022 at 03:41:36PM +0100, Krzysztof Kozlowski wrote:
> On 13/12/2022 15:38, Krzysztof Kozlowski wrote:
> > On 13/12/2022 15:27, Minsuk Kang wrote:
> >> Fix a slab-out-of-bounds read that occurs in nla_put() called from
> >> nfc_genl_send_target() when target->sensb_res_len, which is duplicated
> >> from an nfc_target in pn533, is too large as the nfc_target is not
> >> properly initialized and retains garbage values. Clear nfc_targets with
> >> memset() before they are used.
> >>
> >> Found by a modified version of syzkaller.
> >>
> >> BUG: KASAN: slab-out-of-bounds in nla_put
> >> Call Trace:
> >> memcpy
> >> nla_put
> >> nfc_genl_dump_targets
> >> genl_lock_dumpit
> >> netlink_dump
> >> __netlink_dump_start
> >> genl_family_rcv_msg_dumpit
> >> genl_rcv_msg
> >> netlink_rcv_skb
> >> genl_rcv
> >> netlink_unicast
> >> netlink_sendmsg
> >> sock_sendmsg
> >> ____sys_sendmsg
> >> ___sys_sendmsg
> >> __sys_sendmsg
> >> do_syscall_64
> >>
> >> Fixes: 673088fb42d0 ("NFC: pn533: Send ATR_REQ directly for active device detection")
> >> Fixes: 361f3cb7f9cf ("NFC: DEP link hook implementation for pn533")
> >> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> >
> > How did it happen? From where did you get it?
>
> I double checked - I did not send it. This is some fake tag. Please do
> not add fake/invented/created tags with people's names.
Sorry for my confusion.
https://elixir.bootlin.com/linux/v5.17.1/source/Documentation/process/submitting-patches.rst#L505
I missed the definition of the tag as I did not read the document
carefully and misunderstood that the tag simply means I have got a
reply from maintainers and I should manually attach it if that is
the case. I will rewrite the patch after I make sure I fully
understand the whole rules.
Best regards,
Minsuk
next prev parent reply other threads:[~2022-12-13 16:04 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-13 14:27 [PATCH net v2] nfc: pn533: Clear nfc_target before being used Minsuk Kang
2022-12-13 14:38 ` Krzysztof Kozlowski
2022-12-13 14:41 ` Krzysztof Kozlowski
2022-12-13 16:03 ` Minsuk Kang [this message]
2022-12-13 16:05 ` Krzysztof Kozlowski
2022-12-13 16:22 ` Minsuk Kang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221213160358.GA109198@medve-MS-7D32 \
--to=linuxlovemin@yonsei.ac.kr \
--cc=davem@davemloft.net \
--cc=dokyungs@yonsei.ac.kr \
--cc=jisoo.jang@yonsei.ac.kr \
--cc=krzysztof.kozlowski@linaro.org \
--cc=linma@zju.edu.cn \
--cc=linville@tuxdriver.com \
--cc=netdev@vger.kernel.org \
--cc=sameo@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox