On Mon, Mar 21, 2022 at 08:40:06PM +0300, Denis Efremov wrote: > From: Jordy Zomer <jordy@pwning.systems> > > It appears that there are some buffer overflows in EVT_TRANSACTION. > This happens because the length parameters that are passed to memcpy > come directly from skb->data and are not guarded in any way. > > Link: https://lore.kernel.org/all/20220111164451.3232987-1-jordy@pwning.systems/#t > Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") > Cc: stable@xxxxxxxxxxxxxxx # 4.0+ > Signed-off-by: Jordy Zomer <jordy@pwning.systems> > Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxx> > Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> > Signed-off-by: Denis Efremov <denis.e.efremov@xxxxxxxxxx> > --- > CVE-2022-26490 was assigned to this patch. It looks like it's not in > the stable trees yet. I only added Link:/Fixes:/Cc: stable... to the > commit's message. > > drivers/nfc/st21nfca/se.c | 10 ++++++++++ > 1 file changed, 10 insertions(+) What is the git commit id of this patch in Linus's tree? And your "To:" line was corrupted, might want to check your email client :( thanks, greg k-h
