From patchwork Tue Mar 27 13:45:44 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: harrymorris12@gmail.com X-Patchwork-Id: 10310101 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4729260353 for ; Tue, 27 Mar 2018 13:46:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 38D2929D21 for ; Tue, 27 Mar 2018 13:46:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2D53A29D4B; Tue, 27 Mar 2018 13:46:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C484D29D21 for ; Tue, 27 Mar 2018 13:46:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752687AbeC0Nqh (ORCPT ); Tue, 27 Mar 2018 09:46:37 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:35555 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752457AbeC0Nqg (ORCPT ); Tue, 27 Mar 2018 09:46:36 -0400 Received: by mail-wm0-f67.google.com with SMTP id r82so21990010wme.0 for ; Tue, 27 Mar 2018 06:46:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=YPOIC6v20rHHpoO3Gyw8/9i8ofNzW5ZeCKJ8qjx67ZM=; b=VBcjgDReg5kv5h/nRnbD+XNPV0CNQkDVjYFQ8e1ZqbLoSWGd7ESP+4xdQ7o6nIxolI FKizO3LLE6wWyPmeVEOtBt5xoFLBUhtU0p19PEcNVusV1TGjvNqLzHFIfJzzllhwYfS0 umqNK41ZHhjmWGYGal0Bh6kNcQ5TqV02a7fx+3lzzyAAMSxzaiO+MScLGlcW/9iJ4rhE 48snA6YGp9s5gUX6bUz5QecuAGg9BbH20XXa/KlLOe6i+6MMUtvN0SnD2bSKaPFsgWvp 9eqqX4FwLc/N2nJGQGhJJBKV0pJu2NHxe3LemqZ29yQMLpCvp6O2Rl2gi1hXDnEwtk0Z 4P3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=YPOIC6v20rHHpoO3Gyw8/9i8ofNzW5ZeCKJ8qjx67ZM=; b=dNHMyzyg5ZtawIflWY8i1Sncw32+MJgurh3tumew6Tk67nqiLDu5NPMsCwO2Z0AGXK Ge4DF5Zr2YxD+NsjpC15w5CO2lX8jvROaCk1oqjIOCbthSh+ghOuPiLsueqlrptiKd9N 6eS37DgNOVsX/2oZBRJQJVMfgaIrSJxtNHboMi0XK/VOOpcgJ+l5x3WlC14yStphV0jg eK2EHr9j8+LN6aAZoJpOjHsl8ZAG5OjpW/ZiY++dVW4oXqtmTX4ECsKGORK6NXch4TC4 Pcf1SwOs6ie25XKUigQF6M0I4WhKDdY40FpxlGa6NrXAIE8Fmer4WiK4qlTPzsRWFK0e yZyg== X-Gm-Message-State: AElRT7HyI+jZBv3ClUlYOqA80R6d9uXM2M7Srxu7FcRzuaKU8aohIONu GaFKbX7jGRwkRNa++oNxGD9sFA== X-Google-Smtp-Source: AG47ELvALX72YPKOmaD14QU+l3V+k+n54iCaRDHTvTbHRj2l0wj8hkq4VFZ5++F77qvee0uz0Hg1lQ== X-Received: by 10.28.45.209 with SMTP id t200mr18742752wmt.90.1522158394946; Tue, 27 Mar 2018 06:46:34 -0700 (PDT) Received: from CASCODA211.internal.cascoda ([89.21.229.165]) by smtp.gmail.com with ESMTPSA id l18sm1349725wmh.24.2018.03.27.06.46.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Mar 2018 06:46:34 -0700 (PDT) From: harrymorris12@gmail.com X-Google-Original-From: h.morris@cascoda.com To: linux-wpan@vger.kernel.org Cc: stefan@osg.samsung.com, aring@mojatatu.com, Harry Morris Subject: [PATCH 1/1] ieee802154: ca8210: fix uninitialised data read Date: Tue, 27 Mar 2018 14:45:44 +0100 Message-Id: <20180327134544.16986-2-h.morris@cascoda.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180327134544.16986-1-h.morris@cascoda.com> References: <20180327134544.16986-1-h.morris@cascoda.com> Sender: linux-wpan-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wpan@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Harry Morris In ca8210_test_int_user_write() a user can request the transfer of a frame with a length field (command.length) that is longer than the actual buffer provided (len). In this scenario the driver will copy the buffer contents into the uninitialised command[] buffer, then transfer bytes over the SPI even though only bytes had been populated, potentially leaking sensitive kernel memory. Reported-by: Domen Puncer Kugler Signed-off-by: Harry Morris Tested-by: Harry Morris --- drivers/net/ieee802154/ca8210.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 377af43b8..06cac8d3f 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2511,6 +2511,13 @@ static ssize_t ca8210_test_int_user_write( ); return -EIO; } + if (len != command[1] + 2) { + dev_err( + &priv->spi->dev, + "write len does not match packet length field\n" + ); + return -EMSGSIZE; + } ret = ca8210_test_check_upstream(command, priv->spi); if (ret == 0) {