diff options
| author | Andrey Konovalov <andreyknvl@google.com> | 2018-04-12 18:56:56 +0200 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2018-06-04 06:27:20 +0200 |
| commit | 00afd4c21f2f2e97a1c8eed9d54253439ff9e902 (patch) | |
| tree | 681da5053539528fb49313d916d1c2cfa7ac1565 | |
| parent | 4e4e8232f0ae36573a66f40c765198baa75f327b (diff) | |
| download | nfc-next-00afd4c21f2f2e97a1c8eed9d54253439ff9e902.tar.gz | |
NFC: fix attrs checks in netlink interface
nfc_genl_deactivate_target() relies on the NFC_ATTR_TARGET_INDEX
attribute being present, but doesn't check whether it is actually
provided by the user. Same goes for nfc_genl_fw_download() and
NFC_ATTR_FIRMWARE_NAME.
This patch adds appropriate checks.
Found with syzkaller.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
| -rw-r--r-- | net/nfc/netlink.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c index 376181cc1defc..8b70bf2ac6049 100644 --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -922,7 +922,8 @@ static int nfc_genl_deactivate_target(struct sk_buff *skb, u32 device_idx, target_idx; int rc; - if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) + if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || + !info->attrs[NFC_ATTR_TARGET_INDEX]) return -EINVAL; device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); @@ -1230,7 +1231,8 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) u32 idx; char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; - if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) + if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || + !info->attrs[NFC_ATTR_FIRMWARE_NAME]) return -EINVAL; idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); |