NFC: nci: Add some bounds checking in nci_hci_cmd_received()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 3 Apr 2019 07:12:48 +0000 (10:12 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 16 May 2019 17:41:27 +0000 (19:41 +0200)
commitf5e60565e6bd9a54fa17d62bc397890a70d1d1d2
treeeae4406c73a2fc03b007b5105477127f96189c78
parent21e9515b7d1681db4441325aa5c842efb96667a0
NFC: nci: Add some bounds checking in nci_hci_cmd_received()

[ Upstream commit d7ee81ad09f072eab1681877fc71ec05f9c1ae92 ]

This is similar to commit 674d9de02aa7 ("NFC: Fix possible memory
corruption when handling SHDLC I-Frame commands").

I'm not totally sure, but I think that commit description may have
overstated the danger.  I was under the impression that this data came
from the firmware?  If you can't trust your networking firmware, then
you're already in trouble.

Anyway, these days we add bounds checking where ever we can and we call
it kernel hardening.  Better safe than sorry.

Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
net/nfc/nci/hci.c