]> git.baikalelectronics.ru Git - kernel.git/commit
ieee802154: ca8210: fix uninitialised data read
authorHarry Morris <h.morris@cascoda.com>
Wed, 28 Mar 2018 10:54:27 +0000 (11:54 +0100)
committerStefan Schmidt <stefan@osg.samsung.com>
Thu, 29 Mar 2018 14:51:26 +0000 (16:51 +0200)
commit95e2a03365ad9353de447c689998442f10a0b37f
treeee99af9a7443c785412b163b350ba9e309e44760
parent615ee9a65d45e7b12e96b6073349e4459d4cda78
ieee802154: ca8210: fix uninitialised data read

In ca8210_test_int_user_write() a user can request the transfer of a
frame with a length field (command.length) that is longer than the
actual buffer provided (len). In this scenario the driver will copy
the buffer contents into the uninitialised command[] buffer, then
transfer <data.length> bytes over the SPI even though only <len> bytes
had been populated, potentially leaking sensitive kernel memory.

Also the first 6 bytes of the command buffer must be initialised in case
a malformed, short packet is written and the uninitialised bytes are
read in ca8210_test_check_upstream.

Reported-by: Domen Puncer Kugler <domen.puncer@samsung.com>
Signed-off-by: Harry Morris <h.morris@cascoda.com>
Tested-by: Harry Morris <h.morris@cascoda.com>
Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
drivers/net/ieee802154/ca8210.c