26 Mar, 2020

1 commit


24 Mar, 2020

1 commit

  • The nci_conn_max_data_pkt_payload_size() function sometimes returns
    -EPROTO so "max_size" needs to be signed for the error handling to
    work. We can make "payload_size" an int as well.

    Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver")
    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     

28 Feb, 2020

1 commit

  • The current codebase makes use of the zero-length array language
    extension to the C90 standard, but the preferred mechanism to declare
    variable-length types such as these ones is a flexible array member[1][2],
    introduced in C99:

    struct foo {
    int stuff;
    struct boo array[];
    };

    By making use of the mechanism above, we will get a compiler warning
    in case the flexible array does not occur last in the structure, which
    will help us prevent some kind of undefined behavior bugs from being
    inadvertently introduced[3] to the codebase from now on.

    Also, notice that, dynamic memory allocations won't be affected by
    this change:

    "Flexible array members have incomplete type, and so the sizeof operator
    may not be applied. As a quirk of the original implementation of
    zero-length arrays, sizeof evaluates to zero."[1]

    This issue was found with the help of Coccinelle.

    [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
    [2] https://github.com/KSPP/linux/issues/21
    [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour")

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     

20 Feb, 2020

1 commit

  • The PN544 driver checks the "enable" polarity during of driver's probe and
    it's doing that by turning ON and OFF NFC with different polarities until
    enabling succeeds. It takes some time for the hardware to power-down, and
    thus, to deassert the IRQ that is raised by turning ON the hardware.
    Since the delay after last power-down of the polarity-checking process is
    missed in the code, the interrupt may trigger immediately after installing
    the IRQ handler (right after the checking is done), which results in IRQ
    handler trying to touch the disabled HW and ends with marking NFC as
    'DEAD' during of the driver's probe:

    pn544_hci_i2c 1-002a: NFC: nfc_en polarity : active high
    pn544_hci_i2c 1-002a: NFC: invalid len byte
    shdlc: llc_shdlc_recv_frame: NULL Frame -> link is dead

    This patch fixes the occasional NFC initialization failure on Nexus 7
    device.

    Signed-off-by: Dmitry Osipenko
    Signed-off-by: David S. Miller

    Dmitry Osipenko
     

17 Feb, 2020

1 commit


20 Jan, 2020

1 commit


15 Jan, 2020

1 commit


14 Jan, 2020

1 commit

  • The driver was doing a synchronous uninterruptible bulk-transfer without
    using a timeout. This could lead to the driver hanging on probe due to a
    malfunctioning (or malicious) device until the device is physically
    disconnected. While sleeping in probe the driver prevents other devices
    connected to the same hub from being added to (or removed from) the bus.

    An arbitrary limit of five seconds should be more than enough.

    Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack")
    Signed-off-by: Johan Hovold
    Reviewed-by: Greg Kroah-Hartman
    Signed-off-by: Jakub Kicinski

    Johan Hovold
     

23 Dec, 2019

1 commit


20 Dec, 2019

2 commits

  • Clang warns

    ../drivers/nfc/pn544/pn544.c:696:4: warning: misleading indentation;
    statement is not part of the previous 'if' [-Wmisleading-indentation]
    return nfc_hci_send_cmd(hdev, NFC_HCI_RF_READER_A_GATE,
    ^
    ../drivers/nfc/pn544/pn544.c:692:3: note: previous statement is here
    if (target->nfcid1_len != 4 && target->nfcid1_len != 7 &&
    ^
    1 warning generated.

    This warning occurs because there is a space after the tab on this line.
    Remove it so that the indentation is consistent with the Linux kernel
    coding style and clang no longer warns.

    Fixes: da052850b911 ("NFC: Add pn544 presence check for different targets")
    Link: https://github.com/ClangBuiltLinux/linux/issues/814
    Signed-off-by: Nathan Chancellor
    Signed-off-by: David S. Miller

    Nathan Chancellor
     
  • In s3fwrn5_fw_recv_frame, if fw_info->rsp is not empty, the
    current code causes a crash via BUG_ON. However, s3fwrn5_fw_send_msg
    does not crash in such a scenario. The patch replaces the BUG_ON
    by returning the error to the callers and frees up skb.

    Signed-off-by: Aditya Pakki
    Signed-off-by: David S. Miller

    Aditya Pakki
     

10 Dec, 2019

2 commits

  • devm_acpi_dev_add_driver_gpios() returns -ENXIO if CONFIG_ACPI
    is disabled (e.g. on device tree platforms).
    In this case, nxp-nci will silently fail to probe.

    The other NFC drivers only log a debug message if
    devm_acpi_dev_add_driver_gpios() fails.
    Do the same in nxp-nci to fix this problem.

    Fixes: ad0acfd69add ("NFC: nxp-nci: Get rid of code duplication in ->probe()")
    Cc: Andy Shevchenko
    Signed-off-by: Stephan Gerhold
    Acked-by: Andy Shevchenko
    Signed-off-by: David S. Miller

    Stephan Gerhold
     
  • Convert cpu_to_le16(le16_to_cpu(frame->datalen) + len) to
    use le16_add_cpu(), which is more concise and does the same thing.

    Reported-by: Hulk Robot
    Signed-off-by: Mao Wenan
    Signed-off-by: David S. Miller

    Mao Wenan
     

23 Nov, 2019

1 commit


22 Nov, 2019

1 commit

  • If starting the transfer of a command suceeds but the transfer for the reply
    fails, it is not enough to initiate killing the transfer for the
    command may still be running. You need to wait for the killing to finish
    before you can reuse URB and buffer.

    Reported-and-tested-by: syzbot+711468aa5c3a1eabf863@syzkaller.appspotmail.com
    Signed-off-by: Oliver Neukum
    Signed-off-by: David S. Miller

    Oliver Neukum
     

21 Nov, 2019

1 commit


17 Nov, 2019

1 commit


14 Nov, 2019

1 commit

  • Change dev_up and dev_down functions of struct pn533_phy_ops to return
    int. This way the pn533 core can report errors in the phy layer to upper
    layers.
    The only user of this is currently uart.c and it is changed to report
    the error of a possibly failing call to serdev_device_open.

    Reported-by: coverity-bot
    Addresses-Coverity-ID: 1487395 ("Error handling issues")
    Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver")
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     

12 Nov, 2019

1 commit

  • I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci
    result in a NULL pointer dereference at the moment:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    Oops: 0002 [#1] PREEMPT SMP NOPTI
    CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1
    RIP: 0010:skb_queue_tail+0x25/0x50
    Call Trace:
    nci_recv_frame+0x36/0x90 [nci]
    nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c]
    ? preempt_count_add+0x68/0xa0
    ? irq_forced_thread_fn+0x80/0x80
    irq_thread_fn+0x20/0x60
    irq_thread+0xee/0x180
    ? wake_threads_waitq+0x30/0x30
    kthread+0xfb/0x130
    ? irq_thread_check_affinity+0xd0/0xd0
    ? kthread_park+0x90/0x90
    ret_from_fork+0x1f/0x40

    Afterward the kernel must be rebooted to work properly again.

    This happens because it attempts to call nci_recv_frame() with skb == NULL.
    However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any
    NULL checks for skb, causing the NULL pointer dereference.

    Change the code to call only nxp_nci_fw_recv_frame() in case of an error.
    Make sure to log it so it is obvious that a communication error occurred.
    The error above then becomes:

    nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
    nci: __nci_request: wait_for_completion_interruptible_timeout failed 0
    nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121

    Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
    Signed-off-by: Stephan Gerhold
    Reviewed-by: Andy Shevchenko
    Signed-off-by: David S. Miller

    Stephan Gerhold
     

10 Nov, 2019

1 commit


07 Nov, 2019

1 commit

  • The variable nfcid_skb is not changed in the callee nfc_hci_get_param()
    if error occurs. Consequently, the freed variable nfcid_skb will be
    freed again, resulting in a double free bug. Set nfcid_skb to NULL after
    releasing it to fix the bug.

    Signed-off-by: Pan Bian
    Signed-off-by: David S. Miller

    Pan Bian
     

06 Nov, 2019

1 commit

  • The address of fw_vsc_cfg is on stack. Releasing it with devm_kfree() is
    incorrect, which may result in a system crash or other security impacts.
    The expected object to free is *fw_vsc_cfg.

    Signed-off-by: Pan Bian
    Signed-off-by: David S. Miller

    Pan Bian
     

30 Oct, 2019

6 commits

  • This switches the pn532 UART phy driver from manually polling to the new
    autopoll mechanism.

    Cc: Johan Hovold
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     
  • pn532 devices support an autopoll command, that lets the chip
    automatically poll for selected nfc technologies instead of manually
    looping through every single nfc technology the user is interested in.
    This is faster and less cpu and bus intensive than manually polling.
    This adds this autopoll capability to the pn533 driver.

    Cc: Johan Hovold
    Cc: David Miller
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     
  • This adds the UART phy interface for the pn533 driver.
    The pn533 driver can be used through UART interface this way.
    It is implemented as a serdev device.

    Cc: Johan Hovold
    Cc: Claudiu Beznea
    Cc: David Miller
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     
  • There is a problem in the initialisation and setup of the pn533: It
    registers with nfc too early. It could happen, that it finished
    registering with nfc and someone starts using it. But setup of the pn533
    is not yet finished. Bad or at least unintended things could happen.
    So I split out nfc registering (and unregistering) to seperate functions
    that have to be called late in probe then.
    i2c requires a bit more love: i2c requests an irq in it's probe
    function. 'Commit 32ecc75ded72 ("NFC: pn533: change order operations in
    dev registation")' shows, this can not happen too early. An irq can be
    served before structs are fully initialized. The way chosen to prevent
    this is to request the irq after nfc_alloc_device initialized the
    structs, but before nfc_register_device. So there is now this
    pn532_i2c_nfc_alloc function.

    Cc: Johan Hovold
    Cc: Claudiu Beznea
    Cc: Jakub Kicinski
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     
  • This adds hooks for dev_up and dev_down to the phy_ops. They are
    optional.
    The idea is to inform the phy driver when the nfc chip is really going
    to be used. When it is not used, the phy driver can suspend it's
    interface to the nfc chip to save some power. The nfc chip is considered
    not in use before dev_up and after dev_down.

    Cc: Johan Hovold
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     
  • It is favourable to have one unified compatible string for devices that
    have multiple interfaces. So this adds simply "pn532" as the devicetree
    binding compatible string and makes a note that the old ones are
    deprecated.

    Cc: Johan Hovold
    Cc: Simon Horman
    Signed-off-by: Lars Poeschel
    Signed-off-by: David S. Miller

    Lars Poeschel
     

21 Oct, 2019

1 commit


09 Oct, 2019

1 commit

  • The driver would fail to deregister and its class device and free
    related resources on late probe errors.

    Reported-by: syzbot+cb035c75c03dbe34b796@syzkaller.appspotmail.com
    Fixes: 32ecc75ded72 ("NFC: pn533: change order operations in dev registation")
    Signed-off-by: Johan Hovold
    Signed-off-by: Jakub Kicinski

    Johan Hovold
     

07 Oct, 2019

2 commits


28 Sep, 2019

1 commit


15 Sep, 2019

1 commit


11 Sep, 2019

1 commit


07 Aug, 2019

1 commit


06 Aug, 2019

1 commit

  • Fix two reset-gpio sanity checks which were never converted to use
    gpio_is_valid(), and make sure to use -EINVAL to indicate a missing
    reset line also for the UART-driver module parameter and for the USB
    driver.

    This specifically prevents the UART and USB drivers from incidentally
    trying to request and use gpio 0, and also avoids triggering a WARN() in
    gpio_to_desc() during probe when no valid reset line has been specified.

    Fixes: e33a3f84f88f ("NFC: nfcmrvl: allow gpio 0 for reset signalling")
    Reported-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com
    Tested-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com
    Signed-off-by: Johan Hovold

    Johan Hovold
     

29 Jul, 2019

3 commits

  • This is a simple cleanup to the Kconfig help text as discussed in [1].

    [1] https://marc.info/?t=155774435600001&r=1&w=2

    Suggested-by: Andy Shevchenko
    Suggested-by: Oleg Zhurakivskyy
    Signed-off-by: Sedat Dilek
    Signed-off-by: Andy Shevchenko
    Signed-off-by: David S. Miller

    Sedat Dilek
     
  • This patch clarifies on the supported NXP NCI chips and families
    and lists PN547 and PN548 separately which are known as NPC100
    respectively NPC300.

    This helps to find informations and identify drivers on vendor's
    support websites.

    For details see the discussion in [1] and [2].

    [1] https://marc.info/?t=155774435600001&r=1&w=2
    [2] https://patchwork.kernel.org/project/linux-wireless/list/?submitter=33142

    Suggested-by: Andy Shevchenko
    Suggested-by: Oleg Zhurakivskyy
    Signed-off-by: Sedat Dilek
    Signed-off-by: Andy Shevchenko
    Acked-by: Oleg Zhurakivskyy
    Signed-off-by: David S. Miller

    Sedat Dilek
     
  • It seems contributors follow the style of Kconfig entries where explicit
    'default n' is present. The default 'default' is 'n' already, thus, drop
    these lines from Kconfig to make it more clear.

    Signed-off-by: Andy Shevchenko
    Tested-by: Sedat Dilek
    Signed-off-by: David S. Miller

    Andy Shevchenko