linux-bredos

Files

Dan Carpenter 172cdfc3a5 NFC: nci: Add bounds checking in nci_hci_create_pipe()

commit 110b43ef05 upstream.

The "pipe" variable is a u8 which comes from the network.  If it's more
than 127, then it results in memory corruption in the caller,
nci_hci_connect_gate().

Cc: stable@vger.kernel.org
Fixes: a1b0b94158 ("NFC: nci: Create pipe on specific gate in nci_hci_connect_gate")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-17 09:40:38 +01:00

hci

NFC: hci: Split memcpy() of struct hcp_message flexible array

2022-09-27 07:45:18 -07:00

nci

NFC: nci: Add bounds checking in nci_hci_create_pipe()

2025-02-17 09:40:38 +01:00

af_nfc.c

nfc: fix error handling of nfc_proto_register()

2021-10-13 17:32:38 -07:00

core.c

net: nfc: Directly use ida_alloc()/free()