Eric Lee / smarc-fsl-linux-kernel

22 Jul, 2018

1 commit

  • 115df2a7c   net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. ... Browse Code »

    commit 3bc53be9db21040b5d2de4d455f023c8c494aa68 upstream.

    syzbot is reporting stalls at nfc_llcp_send_ui_frame() [1]. This is
    because nfc_llcp_send_ui_frame() is retrying the loop without any delay
    when nonblocking nfc_alloc_send_skb() returned NULL.

    Since there is no need to use MSG_DONTWAIT if we retry until
    sock_alloc_send_pskb() succeeds, let's use blocking call.
    Also, in case an unexpected error occurred, let's break the loop
    if blocking nfc_alloc_send_skb() failed.

    [1] https://syzkaller.appspot.com/bug?id=4a131cc571c3733e0eff6bc673f4e36ae48f19c6

    Signed-off-by: Tetsuo Handa
    Reported-by: syzbot
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Tetsuo Handa
     

30 May, 2018

1 commit

  • 54881db32   NFC: llcp: Limit size of SDP URI ... Browse Code »

    [ Upstream commit fe9c842695e26d8116b61b80bfb905356f07834b ]

    The tlv_len is u8, so we need to limit the size of the SDP URI. Enforce
    this both in the NLA policy and in the code that performs the allocation
    and copy, to avoid writing past the end of the allocated buffer.

    Fixes: d9b8d8e19b073 ("NFC: llcp: Service Name Lookup netlink interface")
    Signed-off-by: Kees Cook
    Signed-off-by: David S. Miller
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Kees Cook
     

16 Jun, 2017

1 commit

  • 59ae1d127   networking: introduce and use skb_put_data() ... Browse Code »

    A common pattern with skb_put() is to just want to memcpy()
    some data into the new space, introduce skb_put_data() for
    this.

    An spatch similar to the one for skb_put_zero() converts many
    of the places using it:

    @@
    identifier p, p2;
    expression len, skb, data;
    type t, t2;
    @@
    (
    -p = skb_put(skb, len);
    +p = skb_put_data(skb, data, len);
    |
    -p = (t)skb_put(skb, len);
    +p = skb_put_data(skb, data, len);
    )
    (
    p2 = (t2)p;
    -memcpy(p2, data, len);
    |
    -memcpy(p, data, len);
    )

    @@
    type t, t2;
    identifier p, p2;
    expression skb, data;
    @@
    t *p;
    ...
    (
    -p = skb_put(skb, sizeof(t));
    +p = skb_put_data(skb, data, sizeof(t));
    |
    -p = (t *)skb_put(skb, sizeof(t));
    +p = skb_put_data(skb, data, sizeof(t));
    )
    (
    p2 = (t2)p;
    -memcpy(p2, data, sizeof(*p));
    |
    -memcpy(p, data, sizeof(*p));
    )

    @@
    expression skb, len, data;
    @@
    -memcpy(skb_put(skb, len), data, len);
    +skb_put_data(skb, data, len);

    (again, manually post-processed to retain some comments)

    Reviewed-by: Stephen Hemminger
    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

06 Jul, 2016

2 commits

  • 256f3ee3d   NFC: llcp: Fix 2 memory leaks ... Browse Code »

    Once copied into the sk_buff data area using llcp_add_tlv(), the
    allocated TLVs must be freed.

    With this patch nfc_llcp_send_connect() and nfc_llcp_send_cc() don't
    return immediately on success and now free the allocated TLVs.

    Signed-off-by: Thierry Escande
    Signed-off-by: Samuel Ortiz

    Thierry Escande
     
  • de9e5aeb4   NFC: llcp: Fix usage of llcp_add_tlv() ... Browse Code »

    In functions using llcp_add_tlv(), a skb pointer could be set to NULL
    and then reuse afterward.

    With this patch, the skb pointer returned by llcp_add_tlv() is ignored
    since it can only be the passed skb pointer or NULL when the passed TLV
    is NULL. There is also no need to check for the TLV pointer as this is
    done by llcp_add_tlv().

    Signed-off-by: Thierry Escande
    Signed-off-by: Samuel Ortiz

    Thierry Escande
     

25 Feb, 2016

1 commit

  • 81ca7835f   NFC: Use GFP_USER for user-controlled kmalloc ... Browse Code »

    These two functions are called in sendmsg path, and the
    'len' is passed from user-space, so we should not allow
    malicious users to OOM kernel on purpose.

    Reported-by: Dmitry Vyukov
    Acked-by: Eric Dumazet
    Reviewed-by: Julian Calaby
    Signed-off-by: Cong Wang
    Signed-off-by: Samuel Ortiz

    Cong Wang
     

10 Dec, 2014

1 commit

  • b5f185f33   Merge tag 'master-2014-12-08' of git://git.kernel.org/pub/scm/linux/kernel/git/l… ... Browse Code »

    …inville/wireless-next

    John W. Linville says:

    ====================
    pull request: wireless-next 2014-12-08

    Please pull this last batch of pending wireless updates for the 3.19 tree...

    For the wireless bits, Johannes says:

    "This time I have Felix's no-status rate control work, which will allow
    drivers to work better with rate control even if they don't have perfect
    status reporting. In addition to this, a small hwsim fix from Patrik,
    one of the regulatory patches from Arik, and a number of cleanups and
    fixes I did myself.

    Of note is a patch where I disable CFG80211_WEXT so that compatibility
    is no longer selectable - this is intended as a wake-up call for anyone
    who's still using it, and is still easily worked around (it's a one-line
    patch) before we fully remove the code as well in the future."

    For the Bluetooth bits, Johan says:

    "Here's one more bluetooth-next pull request for 3.19:

    - Minor cleanups for ieee802154 & mac802154
    - Fix for the kernel warning with !TASK_RUNNING reported by Kirill A.
    Shutemov
    - Support for another ath3k device
    - Fix for tracking link key based security level
    - Device tree bindings for btmrvl + a state update fix
    - Fix for wrong ACL flags on LE links"

    And...

    "In addition to the previous one this contains two more cleanups to
    mac802154 as well as support for some new HCI features from the
    Bluetooth 4.2 specification.

    From the original request:

    'Here's what should be the last bluetooth-next pull request for 3.19.
    It's rather large but the majority of it is the Low Energy Secure
    Connections feature that's part of the Bluetooth 4.2 specification. The
    specification went public only this week so we couldn't publish the
    corresponding code before that. The code itself can nevertheless be
    considered fairly mature as it's been in development for over 6 months
    and gone through several interoperability test events.

    Besides LE SC the pull request contains an important fix for command
    complete events for mgmt sockets which also fixes some leaks of hci_conn
    objects when powering off or unplugging Bluetooth adapters.

    A smaller feature that's part of the pull request is service discovery
    support. This is like normal device discovery except that devices not
    matching specific UUIDs or strong enough RSSI are filtered out.

    Other changes that the pull request contains are firmware dump support
    to the btmrvl driver, firmware download support for Broadcom BCM20702A0
    variants, as well as some coding style cleanups in 6lowpan &
    ieee802154/mac802154 code.'"

    For the NFC bits, Samuel says:

    "With this one we get:

    - NFC digital improvements for DEP support: Chaining, NACK and ATN
    support added.

    - NCI improvements: Support for p2p target, SE IO operand addition,
    SE operands extensions to support proprietary implementations, and
    a few fixes.

    - NFC HCI improvements: OPEN_PIPE and NOTIFY_ALL_CLEARED support,
    and SE IO operand addition.

    - A bunch of minor improvements and fixes for STMicro st21nfcb and
    st21nfca"

    For the iwlwifi bits, Emmanuel says:

    "Major works are CSA and TDLS. On top of that I have a new
    firmware API for scan and a few rate control improvements.
    Johannes find a few tricks to improve our CPU utilization
    and adds support for a new spin of 7265 called 7265D.
    Along with this a few random things that don't stand out."

    And...

    "I deprecate here -8.ucode since -9 has been published long ago.
    Along with that I have a new activity, we have now better
    a infrastructure for firmware debugging. This will allow to
    have configurable probes insides the firmware.
    Luca continues his work on NetDetect, this feature is now
    complete. All the rest is minor fixes here and there."

    For the Atheros bits, Kalle says:

    "Only ath10k changes this time and no major changes. Most visible are:

    o new debugfs interface for runtime firmware debugging (Yanbo)

    o fix shared WEP (Sujith)

    o don't rebuild whenever kernel version changes (Johannes)

    o lots of refactoring to make it easier to add new hw support (Michal)

    There's also smaller fixes and improvements with no point of listing
    here."

    In addition, there are a few last minute updates to ath5k,
    ath9k, brcmfmac, brcmsmac, mwifiex, rt2x00, rtlwifi, and wil6210.
    Also included is a pull of the wireless tree to pick-up the fixes
    originally included in "pull request: wireless 2014-12-03"...

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

03 Dec, 2014

1 commit

  • e5b53c0a2   NFC: Fix warning "warning: incorrect type in assignment" ... Browse Code »

    Fix warnings:
    net/nfc/llcp_commands.c:421:14: warning: incorrect type in assignment (different base types)
    net/nfc/llcp_commands.c:421:14: expected unsigned short [unsigned] [usertype] miux
    net/nfc/llcp_commands.c:421:14: got restricted __be16
    net/nfc/llcp_commands.c:477:14: warning: incorrect type in assignment (different base types)
    net/nfc/llcp_commands.c:477:14: expected unsigned short [unsigned] [usertype] miux
    net/nfc/llcp_commands.c:477:14: got restricted __be16

    Procedure to reproduce:
    make ARCH=x86_64 allmodconfig
    make C=1 CF=-D__CHECK_ENDIAN__

    Signed-off-by: Christophe Ricard
    Signed-off-by: Samuel Ortiz

    Christophe Ricard
     

24 Nov, 2014

1 commit

20 May, 2014

1 commit

04 Jan, 2014

2 commits

11 Dec, 2013

1 commit

  • 98b32decc   nfc: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: linux-wireless@vger.kernel.org
    CC: Lauro Ramos Venancio
    CC: Aloisio Almeida Jr
    CC: Samuel Ortiz
    Signed-off-by: Jeff Kirsher
    Signed-off-by: John W. Linville

    Jeff Kirsher
     

14 Jun, 2013

1 commit

26 Apr, 2013

1 commit