Commit 10afa279 authored Nov 02, 2021 by Lin Ma Committed by Yang Yingliang Nov 02, 2021

nfc: nci: fix the UAF of rf_conn_info object



mainline inclusion
from mainline-v5.15-rc6
commit 1b1499a8
category: bugfix
bugzilla: NA
CVE: CVE-2021-3760

-------------------------------------------------

The nci_core_conn_close_rsp_packet() function will release the conn_info
with given conn_id. However, it needs to set the rf_conn_info to NULL to
prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger
the UAF.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>

parent cb667442

net/nfc/nci/rsp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -289,6 +289,8 @@ static void nci_core_conn_close_rsp_packet(struct nci_dev *ndev,
		ndev->cur_conn_id);
		if (conn_info) {
		list_del(&conn_info->list);
		if (conn_info == ndev->rf_conn_info)
		ndev->rf_conn_info = NULL;
		devm_kfree(&ndev->nfc_dev->dev, conn_info);
		}
		}