Skip to contentSkip to conversation

NFC: nci: Bounds check struct nfc_target arrays

PATCH Applied Kees Cook 3 participants 3 messages Dec 2, 2022 – Dec 6, 2022

Subsystems (3)
Networking Network drivers NFC
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 NFC: nci: Bounds check struct nfc_target arrays

While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:

memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)

This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks.

Reported-by [email protected]
Link https://lore.kernel.org/lkml/[email protected] open here
Fixes 019c4fbaa790 ("NFC: Add NCI multiple targets support")
Cc Krzysztof Kozlowski <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Cc [email protected]
Signed-off-by Kees Cook <[email protected]>
---
 net/nfc/nci/ntf.c | 6 ++++++
 1 file changed, 6 insertions(+)
net/nfc/nci/ntf.c +6 -0
index 282c51051dcc..994a0a1efb58 100644
@@ -240,6 +240,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
 		target->sens_res = nfca_poll->sens_res;
 		target->sel_res = nfca_poll->sel_res;
 		target->nfcid1_len = nfca_poll->nfcid1_len;
+		if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1))
+			return -EPROTO;
 		if (target->nfcid1_len > 0) {
 			memcpy(target->nfcid1, nfca_poll->nfcid1,
 			       target->nfcid1_len);

@@ -248,6 +250,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
 		nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;
 
 		target->sensb_res_len = nfcb_poll->sensb_res_len;
+		if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res))
+			return -EPROTO;
 		if (target->sensb_res_len > 0) {
 			memcpy(target->sensb_res, nfcb_poll->sensb_res,
 			       target->sensb_res_len);

@@ -256,6 +260,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
 		nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;
 
 		target->sensf_res_len = nfcf_poll->sensf_res_len;
+		if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res))
+			return -EPROTO;
 		if (target->sensf_res_len > 0) {
 			memcpy(target->sensf_res, nfcf_poll->sensf_res,
 			       target->sensf_res_len);
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 17 lines · Kees Cook

While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:

memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)

This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks.

Reported-by [email protected]
Link https://lore.kernel.org/lkml/[email protected] open here
Fixes 019c4fbaa790 ("NFC: Add NCI multiple targets support")
Cc Krzysztof Kozlowski <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Cc [email protected]
Signed-off-by Kees Cook <[email protected]>
Quoted 1 line

---

Reviewed-by Krzysztof Kozlowski <[email protected]>

Best regards,
Krzysztof

CI Applied
#2 lore raw
In reply to Kees Cook
This patch was applied to netdev/net.git (master) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Fri, 2 Dec 2022 13:44:14 -0800 you wrote:

While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:

memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18)

This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks.

[...]

Here is the summary with links:
- NFC: nci: Bounds check struct nfc_target arrays

    https://git.kernel.org/netdev/net/c/e329e71013c9

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html