Krzysztof Kozlowski 4ac06a1e01 nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect ... It's possible to trigger NULL pointer dereference by local unprivileged user, when calling getsockname() after failed bind() (e.g. the bind fails because LLCP_SAP_MAX used as SAP): BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 1 PID: 426 Comm: llcp_sock_getna Not tainted 5.13.0-rc2-next-20210521+ #9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014 Call Trace: llcp_sock_getname+0xb1/0xe0 __sys_getpeername+0x95/0xc0 ? lockdep_hardirqs_on_prepare+0xd5/0x180 ? syscall_enter_from_user_mode+0x1c/0x40 __x64_sys_getpeername+0x11/0x20 do_syscall_64+0x36/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae This can be reproduced with Syzkaller C repro (bind followed by getpeername): https://syzkaller.appspot.com/x/repro.c?x=14def446e00000 Cc: <stable@vger.kernel.org> Fixes: d646960f79 ("NFC: Initial LLCP support") Reported-by: syzbot+80fb126e7f7d8b1a5914@syzkaller.appspotmail.com Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Link: https://lore.kernel.org/r/20210531072138.5219-1-krzysztof.kozlowski@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2021-05-31 22:43:27 -07:00
..
hci	hci: llc_shdlc: style: Simplify bool comparison	2021-01-12 20:18:30 -08:00
nci	NFC: nci: fix memory leak in nci_allocate_device	2021-05-17 13:56:29 -07:00
af_nfc.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
core.c	net: nfc: Fix kerneldoc warnings	2020-10-30 11:57:56 -07:00
digital_core.c	NFC: digital: Correct function name in the kerneldoc comments	2021-03-28 17:56:56 -07:00
digital_dep.c	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req	2021-04-27 15:36:10 -07:00
digital_technology.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288	2019-06-05 17:36:37 +02:00
digital.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288	2019-06-05 17:36:37 +02:00
Kconfig	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
llcp_commands.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
llcp_core.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
llcp_sock.c	nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect	2021-05-31 22:43:27 -07:00
llcp.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-28 17:09:31 -08:00
nfc.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
rawsock.c	net/nfc/rawsock.c: fix a permission check bug	2021-05-10 14:21:02 -07:00