kernel.git/drivers/nfc/nfcsim.c, branch linux-4.9.y

nfc: nfcsim: fix use after free during module unload

2021-08-04T09:58:03Z

commit 5e7b30d24a5b8cb691c173b45b50e3ca0191be19 upstream. There is a use after free memory corruption during module exit: - nfcsim_exit() - nfcsim_device_free(dev0) - nfc_digital_unregister_device() This iterates over command queue and frees all commands, - dev->up = false - nfcsim_link_shutdown() - nfcsim_link_recv_wake() This wakes the sleeping thread nfcsim_link_recv_skb(). - nfcsim_link_recv_skb() Wake from wait_event_interruptible_timeout(), call directly the deb->cb callback even though (dev->up == false), - digital_send_cmd_complete() Dereference of "struct digital_cmd" cmd which was freed earlier by nfc_digital_unregister_device(). This causes memory corruption shortly after (with unrelated stack trace): nfc nfc0: NFC: nfcsim_recv_wq: Device is down llcp: nfc_llcp_recv: err -19 nfc nfc1: NFC: nfcsim_recv_wq: Device is down BUG: unable to handle page fault for address: ffffffffffffffed Call Trace: fsnotify+0x54b/0x5c0 __fsnotify_parent+0x1fe/0x300 ? vfs_write+0x27c/0x390 vfs_write+0x27c/0x390 ksys_write+0x63/0xe0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae KASAN report: BUG: KASAN: use-after-free in digital_send_cmd_complete+0x16/0x50 Write of size 8 at addr ffff88800a05f720 by task kworker/0:2/71 Workqueue: events nfcsim_recv_wq [nfcsim] Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x21/0x140 ? digital_send_cmd_complete+0x16/0x50 ? digital_send_cmd_complete+0x16/0x50 kasan_report.cold+0x7f/0x11b ? digital_send_cmd_complete+0x16/0x50 ? digital_dep_link_down+0x60/0x60 digital_send_cmd_complete+0x16/0x50 nfcsim_recv_wq+0x38f/0x3d5 [nfcsim] ? nfcsim_in_send_cmd+0x4a/0x4a [nfcsim] ? lock_is_held_type+0x98/0x110 ? finish_wait+0x110/0x110 ? rcu_read_lock_sched_held+0x9c/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x12e/0x1f0 This flow of calling digital_send_cmd_complete() callback on driver exit is specific to nfcsim which implements reading and sending work queues. Since the NFC digital device was unregistered, the callback should not be called. Fixes: 204bddcb508f ("NFC: nfcsim: Make use of the Digital layer") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

NFC: nfcsim: Simulate lost frames through debugfs entry

2016-07-19T21:24:49Z

This patch allows to simulate the lost of frames exchanged between the 2 nfcsim devices through a control entry in the debugfs and is used as follow: echo n > /sys/kernel/debug/nfcsim/nfcX/dropframe Where n specifies the number of frames to be dropped between 0 and 255 and nfcX is either nfc0 or nfc1, one of the two nfcsim devices. In the following example, the next frame that should be sent by the nfc0 device will be dropped and thus not received by the nfc1 device: echo 1 > /sys/kernel/debug/nfcsim/nfc0/dropframe The value of 0 can be used to reset the dropframe counter. Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: nfcsim: Add support for sysfs control entry

2016-07-19T21:23:29Z

The idea is to have a way to control and/or modify the behavior of the nfcsim virtual devices. This patch creates a folder tree in the debug filesystem. The debugfs is usually mounted into /sys/kernel/debug and the nfcsim entries are located in DEBUGFS/nfcsim/nfcX/ where X is either 0 or 1 depending on the device you want to address. These folders are empty for now and control entries will be added by upcoming commits. Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: nfcsim: Make use of the Digital layer

2016-07-04T10:36:30Z

With this complete rewrite, the loopback nfcsim driver now relies on the Digital layer of the nfc stack. As with the previous version, 2 nfc devices are declared when the driver is initialized. The driver supports the NFC_DEP protocol in NFC-A and NFC-F technologies. The 2 devices are using a pair of virtual links for sk_buff exchange. The out-link of one device is the in-link of the other and conversely. To receive data, a device calls nfcsim_link_recv_skb() on its in-link and waits for incoming data on a wait queue. To send data, a device calls nfcsim_link_send_skb() on its out-link which stores the passed skb and signals its wait queue. If the peer device was in the nfcsim_link_recv_skb() call, it will be signaled and will be able to pass the received sk_buff up to the Digital layer. Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: add rx delay sysfs parameter for nfcsim workqueue

2015-12-20T23:07:27Z

added the rx delay parameter as a device tunable parameter. Signed-off-by: Saurabh Sengar Signed-off-by: Samuel Ortiz

NFC: netlink: Add mode parameter to deactivate_target functions

2015-10-27T02:55:12Z

In order to manage in a better way the nci poll mode state machine, add mode parameter to deactivate_target functions. This way we can manage different target state. mode parameter make sense only in nci core. Signed-off-by: Christophe Ricard Signed-off-by: Samuel Ortiz

NFC: Convert nfc_dev_info and nfc_dev_err to nfc_

2013-09-24T23:35:39Z

Use a more standard kernel style macro logging name. Standardize the spacing of the "NFC: " prefix. Add \n to uses, remove from macro. Fix the defective uses that already had a \n. Signed-off-by: Joe Perches Signed-off-by: Samuel Ortiz

NFC: Replace nfc_dev_dbg with dev_dbg

2013-09-24T23:35:39Z

Use the generic kernel function instead of a home-grown one that does the same thing. Add \n to uses not at the macro. Don't add \n where the nfc_dev_dbg macro mistakenly had them already. Signed-off-by: Joe Perches Signed-off-by: Samuel Ortiz

NFC: Fix missing static declarations

2013-08-13T22:28:16Z

This patch fixes 3 sparse warnings: nfcsim.c:63:25: sparse: symbol 'wq' was not declared. nfcsim.c:484:12: sparse: symbol 'nfcsim_init' was not declared. nfcsim.c:525:13: sparse: symbol 'nfcsim_exit' was not declared. Reported-by: Fengguang Wu Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: Add a nfc hardware simulation driver

2013-06-14T11:45:06Z

This driver declares two virtual NFC devices supporting NFC-DEP protocol. An LLCP connection can be established between them and all packets sent from one device is sent back to the other, acting as loopback devices. Once established, the LLCP link can be disconnected by disabling the target device (with rfkill, nfctool, or neard disable-adapter test script). Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz