leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ieee802154: ca8210: fix uninitialised data read

Browse Source 
In ca8210_test_int_user_write() a user can request the transfer of a
frame with a length field (command.length) that is longer than the
actual buffer provided (len). In this scenario the driver will copy
the buffer contents into the uninitialised command[] buffer, then
transfer <data.length> bytes over the SPI even though only <len> bytes
had been populated, potentially leaking sensitive kernel memory.

Also the first 6 bytes of the command buffer must be initialised in case
a malformed, short packet is written and the uninitialised bytes are
read in ca8210_test_check_upstream.

Reported-by: Domen Puncer Kugler <domen.puncer@samsung.com>
Signed-off-by: Harry Morris <h.morris@cascoda.com>
Tested-by: Harry Morris <h.morris@cascoda.com>
Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
This commit is contained in:
Harry Morris 2018-03-28 11:54:27 +01:00 committed by Stefan Schmidt
parent 8fd4bc8a15
commit 86674a97f5
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/ieee802154/ca8210.c
View File

@ -2493,13 +2493,14 @@ static ssize_t ca8210_test_int_user_write(
struct ca8210_priv *priv = filp->private_data; struct ca8210_priv *priv = filp->private_data;
u8 command[CA8210_SPI_BUF_SIZE]; u8 command[CA8210_SPI_BUF_SIZE];
if (len > CA8210_SPI_BUF_SIZE) { memset(command, SPI_IDLE, 6);
if (len > CA8210_SPI_BUF_SIZE || len < 2) {
dev_warn( dev_warn(
&priv->spi->dev, &priv->spi->dev,
"userspace requested erroneously long write (%zu)\n", "userspace requested erroneous write length (%zu)\n",
len len
); );
return -EMSGSIZE; return -EBADE;
} }
ret = copy_from_user(command, in_buf, len); ret = copy_from_user(command, in_buf, len);
@ -2511,6 +2512,13 @@ static ssize_t ca8210_test_int_user_write(
); );
return -EIO; return -EIO;
} }
if (len != command[1] + 2) {
dev_err(
&priv->spi->dev,
"write len does not match packet length field\n"
);
return -EBADE;
}
ret = ca8210_test_check_upstream(command, priv->spi); ret = ca8210_test_check_upstream(command, priv->spi);
if (ret == 0) { if (ret == 0) {