Eric Lee / smarc-ti-linux-kernel

12 Apr, 2014

1 commit

  • 676d23690   net: Fix use after free by removing length arg from sk_data_ready callbacks. ... Browse Code »
    13

    Several spots in the kernel perform a sequence like:

    skb_queue_tail(&sk->s_receive_queue, skb);
    sk->sk_data_ready(sk, skb->len);

    But at the moment we place the SKB onto the socket receive queue it
    can be consumed and freed up. So this skb->len access is potentially
    to freed up memory.

    Furthermore, the skb->len can be modified by the consumer so it is
    possible that the value isn't accurate.

    And finally, no actual implementation of this callback actually uses
    the length argument. And since nobody actually cared about it's
    value, lots of call sites pass arbitrary values in such as '0' and
    even '1'.

    So just remove the length argument from the callback, that way there
    is no confusion whatsoever and all of these use-after-free cases get
    fixed as a side effect.

    Based upon a patch by Eric Dumazet and his suggestion to audit this
    issue tree-wide.

    Signed-off-by: David S. Miller

    David S. Miller
     

18 Mar, 2014

1 commit

  • 20d83f246   Merge tag 'nfc-next-3.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-next ... Browse Code »

    Samuel Ortiz says:

    "NFC: 3.15: First pull request

    This is the NFC pull request for 3.15. With this one we have:

    - Support for ISO 15693 a.k.a. NFC vicinity a.k.a. Type 5 tags. ISO
    15693 are long range (1 - 2 meters) vicinity tags/cards. The kernel
    now supports those through the NFC netlink and digital APIs.

    - Support for TI's trf7970a chipset. This chipset relies on the NFC
    digital layer and the driver currently supports type 2, 4A and 5 tags.

    - Support for NXP's pn544 secure firmare download. The pn544 C3 chipsets
    relies on a different firmware download protocal than the C2 one. We
    now support both and use the right one depending on the version we
    detect at runtime.

    - Support for 4A tags from the NFC digital layer.

    - A bunch of cleanups and minor fixes from Axel Lin and Thierry Escande."

    Signed-off-by: John W. Linville

    John W. Linville
     

15 Mar, 2014

3 commits

11 Mar, 2014

1 commit

24 Feb, 2014

5 commits

17 Feb, 2014

6 commits

26 Jan, 2014

1 commit

  • 4ba9920e5   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next ... Browse Code »

    Pull networking updates from David Miller:

    1) BPF debugger and asm tool by Daniel Borkmann.

    2) Speed up create/bind in AF_PACKET, also from Daniel Borkmann.

    3) Correct reciprocal_divide and update users, from Hannes Frederic
    Sowa and Daniel Borkmann.

    4) Currently we only have a "set" operation for the hw timestamp socket
    ioctl, add a "get" operation to match. From Ben Hutchings.

    5) Add better trace events for debugging driver datapath problems, also
    from Ben Hutchings.

    6) Implement auto corking in TCP, from Eric Dumazet. Basically, if we
    have a small send and a previous packet is already in the qdisc or
    device queue, defer until TX completion or we get more data.

    7) Allow userspace to manage ipv6 temporary addresses, from Jiri Pirko.

    8) Add a qdisc bypass option for AF_PACKET sockets, from Daniel
    Borkmann.

    9) Share IP header compression code between Bluetooth and IEEE802154
    layers, from Jukka Rissanen.

    10) Fix ipv6 router reachability probing, from Jiri Benc.

    11) Allow packets to be captured on macvtap devices, from Vlad Yasevich.

    12) Support tunneling in GRO layer, from Jerry Chu.

    13) Allow bonding to be configured fully using netlink, from Scott
    Feldman.

    14) Allow AF_PACKET users to obtain the VLAN TPID, just like they can
    already get the TCI. From Atzm Watanabe.

    15) New "Heavy Hitter" qdisc, from Terry Lam.

    16) Significantly improve the IPSEC support in pktgen, from Fan Du.

    17) Allow ipv4 tunnels to cache routes, just like sockets. From Tom
    Herbert.

    18) Add Proportional Integral Enhanced packet scheduler, from Vijay
    Subramanian.

    19) Allow openvswitch to mmap'd netlink, from Thomas Graf.

    20) Key TCP metrics blobs also by source address, not just destination
    address. From Christoph Paasch.

    21) Support 10G in generic phylib. From Andy Fleming.

    22) Try to short-circuit GRO flow compares using device provided RX
    hash, if provided. From Tom Herbert.

    The wireless and netfilter folks have been busy little bees too.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2064 commits)
    net/cxgb4: Fix referencing freed adapter
    ipv6: reallocate addrconf router for ipv6 address when lo device up
    fib_frontend: fix possible NULL pointer dereference
    rtnetlink: remove IFLA_BOND_SLAVE definition
    rtnetlink: remove check for fill_slave_info in rtnl_have_link_slave_info
    qlcnic: update version to 5.3.55
    qlcnic: Enhance logic to calculate msix vectors.
    qlcnic: Refactor interrupt coalescing code for all adapters.
    qlcnic: Update poll controller code path
    qlcnic: Interrupt code cleanup
    qlcnic: Enhance Tx timeout debugging.
    qlcnic: Use bool for rx_mac_learn.
    bonding: fix u64 division
    rtnetlink: add missing IFLA_BOND_AD_INFO_UNSPEC
    sfc: Use the correct maximum TX DMA ring size for SFC9100
    Add Shradha Shah as the sfc driver maintainer.
    net/vxlan: Share RX skb de-marking and checksum checks with ovs
    tulip: cleanup by using ARRAY_SIZE()
    ip_tunnel: clear IPCB in ip_tunnel_xmit() in case dst_link_failure() is called
    net/cxgb4: Don't retrieve stats during recovery
    ...

    Linus Torvalds
     

23 Jan, 2014

1 commit

  • bb1281f2a   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial ... Browse Code »

    Pull trivial tree updates from Jiri Kosina:
    "Usual rocket science stuff from trivial.git"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
    neighbour.h: fix comment
    sched: Fix warning on make htmldocs caused by wait.h
    slab: struct kmem_cache is protected by slab_mutex
    doc: Fix typo in USB Gadget Documentation
    of/Kconfig: Spelling s/one/once/
    mkregtable: Fix sscanf handling
    lp5523, lp8501: comment improvements
    thermal: rcar: comment spelling
    treewide: fix comments and printk msgs
    IXP4xx: remove '1 &&' from a condition check in ixp4xx_restart()
    Documentation: update /proc/uptime field description
    Documentation: Fix size parameter for snprintf
    arm: fix comment header and macro name
    asm-generic: uaccess: Spelling s/a ny/any/
    mtd: onenand: fix comment header
    doc: driver-model/platform.txt: fix a typo
    drivers: fix typo in DEVTMPFS_MOUNT Kconfig help text
    doc: Fix typo (acces_process_vm -> access_process_vm)
    treewide: Fix typos in printk
    drivers/gpu/drm/qxl/Kconfig: reformat the help text
    ...

    Linus Torvalds
     

19 Jan, 2014

1 commit

  • 342dfc306   net: add build-time checks for msg->msg_name size ... Browse Code »

    This is a follow-up patch to f3d3342602f8bc ("net: rework recvmsg
    handler msg_name and msg_namelen logic").

    DECLARE_SOCKADDR validates that the structure we use for writing the
    name information to is not larger than the buffer which is reserved
    for msg->msg_name (which is 128 bytes). Also use DECLARE_SOCKADDR
    consistently in sendmsg code paths.

    Signed-off-by: Steffen Hurrle
    Suggested-by: Hannes Frederic Sowa
    Acked-by: Hannes Frederic Sowa
    Signed-off-by: David S. Miller

    Steffen Hurrle
     

18 Jan, 2014

1 commit

15 Jan, 2014

2 commits

08 Jan, 2014

2 commits

  • b711ad524   NFC: digital: Set rf tech and crc functions when receiving a PSL_REQ ... Browse Code »

    This patch sets the correct rf tech value and crc functions in target
    mode when receiving a PSL_REQ, as done when receiving an ATR_REQ.

    Signed-off-by: Thierry Escande
    Signed-off-by: Samuel Ortiz

    Thierry Escande
     
  • 48e104451   NFC: digital: Set current target active on activate_target() call ... Browse Code »

    The curr_protocol field of nfc_digital_dev structure used to determine
    if a target is currently active was set too soon, immediately when a
    target is found. This is not good since there is no other way than
    deactivate_target() to reset curr_protocol and if activate_target() is
    not called, the target remains active and it's not possible to put the
    device in poll mode anymore.

    With this patch curr_protocol is set when nfc core activates a target,
    puts a device up, or when an ATR_REQ is received in target mode.

    Signed-off-by: Thierry Escande
    Signed-off-by: Samuel Ortiz

    Thierry Escande
     

07 Jan, 2014

4 commits

06 Jan, 2014

1 commit

  • fa9be5f00   NFC: NCI: Cancel cmd_timer in nci_close_device() ... Browse Code »

    nci_close_device() sends nci reset command to the device.
    If there is no response for this command, nci request timeout
    occurs first and then cmd timeout happens. Because command
    timer has started after sending the command.

    We are immediately flushing command workqueue after nci
    timeout. Later we will try to schedule cmd_work in command
    timer which leads to a crash.

    Cancel cmd_timer before flushing the workqueue to fix the
    problem.

    Signed-off-by: Amitkumar Karwar
    Signed-off-by: Bing Zhao
    Signed-off-by: Samuel Ortiz

    Amitkumar Karwar
     

04 Jan, 2014

7 commits

19 Dec, 2013

1 commit

11 Dec, 2013

1 commit

  • 98b32decc   nfc: Fix FSF address in file headers ... Browse Code »

    Several files refer to an old address for the Free Software Foundation
    in the file header comment. Resolve by replacing the address with
    the URL so that we do not have to keep
    updating the header comments anytime the address changes.

    CC: linux-wireless@vger.kernel.org
    CC: Lauro Ramos Venancio
    CC: Aloisio Almeida Jr
    CC: Samuel Ortiz
    Signed-off-by: Jeff Kirsher
    Signed-off-by: John W. Linville

    Jeff Kirsher
     

21 Nov, 2013

1 commit