queue-5.0/nfc-nci-add-some-bounds-checking-in-nci_hci_cmd_received.patch

   1 From foo@baz Sat Apr 20 16:43:09 CEST 2019
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Wed, 3 Apr 2019 10:12:48 +0300
   4 Subject: NFC: nci: Add some bounds checking in nci_hci_cmd_received()
   5
   6 From: Dan Carpenter <dan.carpenter@oracle.com>
   7
   8 [ Upstream commit d7ee81ad09f072eab1681877fc71ec05f9c1ae92 ]
   9
  10 This is similar to commit 674d9de02aa7 ("NFC: Fix possible memory
  11 corruption when handling SHDLC I-Frame commands").
  12
  13 I'm not totally sure, but I think that commit description may have
  14 overstated the danger.  I was under the impression that this data came
  15 from the firmware?  If you can't trust your networking firmware, then
  16 you're already in trouble.
  17
  18 Anyway, these days we add bounds checking where ever we can and we call
  19 it kernel hardening.  Better safe than sorry.
  20
  21 Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
  22 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  net/nfc/nci/hci.c |    8 ++++++++
  26  1 file changed, 8 insertions(+)
  27
  28 --- a/net/nfc/nci/hci.c
  29 +++ b/net/nfc/nci/hci.c
  30 @@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct
  31                 create_info = (struct nci_hci_create_pipe_resp *)skb->data;
  32                 dest_gate = create_info->dest_gate;
  33                 new_pipe = create_info->pipe;
  34 +               if (new_pipe >= NCI_HCI_MAX_PIPES) {
  35 +                       status = NCI_HCI_ANY_E_NOK;
  36 +                       goto exit;
  37 +               }
  38
  39                 /* Save the new created pipe and bind with local gate,
  40                  * the description for skb->data[3] is destination gate id
  41 @@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct
  42                         goto exit;
  43                 }
  44                 delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
  45 +               if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
  46 +                       status = NCI_HCI_ANY_E_NOK;
  47 +                       goto exit;
  48 +               }
  49
  50                 ndev->hci_dev->pipes[delete_info->pipe].gate =
  51                                                 NCI_HCI_INVALID_GATE;