kernel.git/drivers/nfc/st21nfca, branch linux-4.9.y

nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

2022-06-14T14:52:41Z

commit 996419e0594abb311fb958553809f24f38e7abbe upstream. Error paths do not free previously allocated memory. Add devm_kfree() to those failure paths. Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION") Cc: stable@vger.kernel.org Signed-off-by: Martin Faltesek Reviewed-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman

nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION

2022-06-14T14:52:41Z

commit 77e5fe8f176a525523ae091d6fd0fbb8834c156d upstream. The first validation check for EVT_TRANSACTION has two different checks tied together with logical AND. One is a check for minimum packet length, and the other is for a valid aid_tag. If either condition is true (fails), then an error should be triggered. The fix is to change && to ||. Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Cc: stable@vger.kernel.org Signed-off-by: Martin Faltesek Reviewed-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman

nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION

2022-03-28T06:06:05Z

commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream. It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way. Signed-off-by: Jordy Zomer Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Denis Efremov Signed-off-by: Greg Kroah-Hartman

NFC: st21nfca: add missed kfree_skb() in an error path

2020-06-11T07:22:21Z

[ Upstream commit 3decabdc714ca56c944f4669b4cdec5c2c1cea23 ] st21nfca_tm_send_atr_res() misses to call kfree_skb() in an error path. Add the missed function call to fix it. Fixes: 1892bf844ea0 ("NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode") Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

NFC: st21nfca: fix double free

2019-11-12T18:15:40Z

[ Upstream commit 99a8efbb6e30b72ac98cecf81103f847abffb1e5 ] The variable nfcid_skb is not changed in the callee nfc_hci_get_param() if error occurs. Consequently, the freed variable nfcid_skb will be freed again, resulting in a double free bug. Set nfcid_skb to NULL after releasing it to fix the bug. Signed-off-by: Pan Bian Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

st21nfca_connectivity_event_received: null check the allocation

2019-09-06T08:19:32Z

[ Upstream commit 9891d06836e67324c9e9c4675ed90fc8b8110034 ] devm_kzalloc may fail and return null. So the null check is needed. Signed-off-by: Navid Emamdoost Signed-off-by: David S. Miller Signed-off-by: Sasha Levin

nfc: st21nfca: Remove duplicated ST21NFCA_ESE_HOST_ID from se.c

2016-05-03T23:40:28Z

ST21NFCA_ESE_HOST_ID is already defined in st21nfca.h. Signed-off-by: Christophe Ricard Signed-off-by: Samuel Ortiz

NFC: st21nfca: Drop two useless checks in ACPI probe path

2016-05-03T23:36:24Z

When st21nfca_hci_i2c_acpi_request_resources() gets called we already know that the entries in ->acpi_match_table have matched ACPI ID of the device. In addition I2C client pointer cannot be NULL in any case (otherwise I2C core would not call ->probe() for the driver in the first place). Drop the two useless checks from the driver. Signed-off-by: Christophe Ricard Signed-off-by: Samuel Ortiz

nfc: st21nfca: A APDU_READER_GATE pipe is unexpected on a UICC

2016-05-03T23:33:52Z

An APDU_READER_GATE pipe is not expected on a UICC. Be more explicit so that an other secure element form factor (SD card) does not prompt this message. Signed-off-by: Christophe Ricard Signed-off-by: Samuel Ortiz

nfc: st21nfca: Simplify white list building

2016-05-03T23:31:56Z

Simplify white list Building Signed-off-by: Christophe Ricard Signed-off-by: Samuel Ortiz