[PATCH] nfc: Fix the sockaddr length sanitization in llcp_sock_connect

2017-05-24 Thread Mateusz Jurczyk
be subsequently read back through the user-mode getsockname() function (handled by llcp_sock_getname()). This would result in the disclosure of up to ~70 uninitialized bytes from the kernel stack to user-mode clients capable of creating AFC_NFC sockets. Signed-off-by: Mateusz Jurczyk <mjurc...@google.

[PATCH] nfc: Add sockaddr length checks before accessing sa_family in bind handlers

2017-06-13 Thread Mateusz Jurczyk
in operating on uninitialized memory while referencing .sa_family. Signed-off-by: Mateusz Jurczyk <mjurc...@google.com> --- net/nfc/llcp_sock.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index 2ffb18e73df6..80cf35ed320a