kernel.git/drivers/nfc/pn533, branch linux-4.9.y

nfc: pn533: Clear nfc_target before being used

2023-01-07T11:07:29Z

[ Upstream commit 9f28157778ede0d4f183f7ab3b46995bb400abbe ] Fix a slab-out-of-bounds read that occurs in nla_put() called from nfc_genl_send_target() when target->sensb_res_len, which is duplicated from an nfc_target in pn533, is too large as the nfc_target is not properly initialized and retains garbage values. Clear nfc_targets with memset() before they are used. Found by a modified version of syzkaller. BUG: KASAN: slab-out-of-bounds in nla_put Call Trace: memcpy nla_put nfc_genl_dump_targets genl_lock_dumpit netlink_dump __netlink_dump_start genl_family_rcv_msg_dumpit genl_rcv_msg netlink_rcv_skb genl_rcv netlink_unicast netlink_sendmsg sock_sendmsg ____sys_sendmsg ___sys_sendmsg __sys_sendmsg do_syscall_64 Fixes: 673088fb42d0 ("NFC: pn533: Send ATR_REQ directly for active device detection") Fixes: 361f3cb7f9cf ("NFC: DEP link hook implementation for pn533") Signed-off-by: Minsuk Kang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221214015139.119673-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails

2021-11-26T10:48:39Z

[ Upstream commit 9fec40f850658e00a14a7dd9e06f7fbc7e59cc4a ] skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs, but follow error handler branch when pn533_fill_fragment_skbs() fails, skb is freed again, results in double free issue. Fix this by not free skb in error path of pn533_fill_fragment_skbs. Fixes: 963a82e07d4e ("NFC: pn533: Split large Tx frames in chunks") Fixes: 93ad42020c2d ("NFC: pn533: Target mode Tx fragmentation support") Signed-off-by: Chengfeng Ye Reviewed-by: Dan Carpenter Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

nfc: pn533: prevent potential memory corruption

2021-05-22T08:40:26Z

[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ] If the "type_a->nfcid_len" is too large then it would lead to memory corruption in pn533_target_found_type_a() when we do: memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len); Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

NFC: pn533: Fix wrong GFP flag usage

2018-08-24T11:12:32Z

[ Upstream commit ecc443c03fb14abfb8a6af5e3b2d43b5257e60f2 ] pn533_recv_response() is an urb completion handler, so it must use GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping context, so the pn533_submit_urb_for_response() there (and only there) can use the regular GFP_KERNEL flags. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134 Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...") Cc: Michael Thalmeier Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

NFC: pn533: change order of free_irq and dev unregistration

2018-03-22T08:17:46Z

[ Upstream commit 068a496c4525c638ffab56449d905b88ef97fe32 ] Change order of free_irq and dev unregistration. It fixes situation when device already unregistered and an interrupt happens and nobody can handle it. Signed-off-by: Andrey Rusalin Signed-off-by: Samuel Ortiz Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

NFC: pn533: double free on error in probe()

2016-07-04T10:15:00Z

We can't pass devm_ allocated pointers to kfree() because they will be freed again after the drive is unloaded. Signed-off-by: Dan Carpenter Signed-off-by: Samuel Ortiz

NFC: pn533: handle interrupted commands in pn533_recv_frame

2016-05-09T22:01:47Z

When pn533_recv_frame is called from within abort_command context the current dev->cmd is not guaranteed to be set. Additionally on receiving an error status we can omit frame checking and simply schedule the workqueue. Signed-off-by: Michael Thalmeier Signed-off-by: Samuel Ortiz

NFC: pn533: reset poll modulation list before calling targets_found

2016-05-09T22:01:16Z

We need to reset the poll modulation list before calling nfc_targets_found because otherwise userspace could run before the modulation list is cleared and then get a "Cannot activate target while polling" error upon calling activate_target. Signed-off-by: Michael Thalmeier Signed-off-by: Samuel Ortiz

NFC: pn533: i2c: do not call pn533_recv_frame with aborted commands

2016-05-09T21:59:47Z

When a command gets aborted the pn533 core does not need any RX frames that may be received until a new frame is sent. Signed-off-by: Michael Thalmeier Signed-off-by: Samuel Ortiz

NFC: pn533: fix order of initialization

2016-05-09T21:59:18Z

Correctly call nfc_set_parent_dev before nfc_register_device. Otherwise the driver will OOPS when being removed. Signed-off-by: Michael Thalmeier Signed-off-by: Samuel Ortiz