mirror of
https://github.com/torvalds/linux.git
synced 2026-10-05 02:39:02 +02:00
7dcf371a35
nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-
terminated strings to pr_debug() using the %s format specifier.
The buffers are allocated via kmemdup() or come from netlink
attributes and are not guaranteed to be null-terminated, causing
__dynamic_pr_debug() to read beyond the allocated region:
KASAN: slab-out-of-bounds Read in __dynamic_pr_debug
Fix both call sites by using %.*s with the explicit length to limit
the output to the actual length of the string.
Fixes:
|
||
|---|---|---|
| .. | ||
| hci | ||
| nci | ||
| af_nfc.c | ||
| core.c | ||
| digital_core.c | ||
| digital_dep.c | ||
| digital_technology.c | ||
| digital.h | ||
| Kconfig | ||
| llcp_commands.c | ||
| llcp_core.c | ||
| llcp_sock.c | ||
| llcp.h | ||
| Makefile | ||
| netlink.c | ||
| nfc.h | ||
| rawsock.c | ||