linux-stable.git/drivers/nfc, branch linux-5.14.y

nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails

2021-11-17T10:04:42+00:00

[ Upstream commit 9fec40f850658e00a14a7dd9e06f7fbc7e59cc4a ]

skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb in error path of pn533_fill_fragment_skbs.

Fixes: 963a82e07d4e ("NFC: pn533: Split large Tx frames in chunks")
Fixes: 93ad42020c2d ("NFC: pn533: Target mode Tx fragmentation support")
Signed-off-by: Chengfeng Ye 
Reviewed-by: Dan Carpenter 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

nfc: port100: fix using -ERRNO as command type mask

2021-11-02T18:50:51+00:00

commit 2195f2062e4cc93870da8e71c318ef98a1c51cef upstream.

During probing, the driver tries to get a list (mask) of supported
command types in port100_get_command_type_mask() function.  The value
is u64 and 0 is treated as invalid mask (no commands supported).  The
function however returns also -ERRNO as u64 which will be interpret as
valid command mask.

Return 0 on every error case of port100_get_command_type_mask(), so the
probing will stop.

Cc: 
Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation")
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

nfc: st-nci: Add SPI ID matching DT compatible

2021-09-30T08:13:00+00:00

[ Upstream commit 31339440b2d0a4987030aac026adbaba44e22490 ]

Currently autoloading for SPI devices does not use the DT ID table, it uses
SPI modalises. Supporting OF modalises is going to be difficult if not
impractical, an attempt was made but has been reverted, so ensure that
module autoloading works for this driver by adding the part name used in
the compatible to the list of SPI IDs.

Fixes: 96c8395e2166 ("spi: Revert modalias changes")
Signed-off-by: Mark Brown 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

nfc: nfcsim: fix use after free during module unload

2021-07-28T09:20:16+00:00

There is a use after free memory corruption during module exit:
 - nfcsim_exit()
  - nfcsim_device_free(dev0)
    - nfc_digital_unregister_device()
      This iterates over command queue and frees all commands,
    - dev->up = false
    - nfcsim_link_shutdown()
      - nfcsim_link_recv_wake()
        This wakes the sleeping thread nfcsim_link_recv_skb().

 - nfcsim_link_recv_skb()
   Wake from wait_event_interruptible_timeout(),
   call directly the deb->cb callback even though (dev->up == false),
   - digital_send_cmd_complete()
     Dereference of "struct digital_cmd" cmd which was freed earlier by
     nfc_digital_unregister_device().

This causes memory corruption shortly after (with unrelated stack
trace):

  nfc nfc0: NFC: nfcsim_recv_wq: Device is down
  llcp: nfc_llcp_recv: err -19
  nfc nfc1: NFC: nfcsim_recv_wq: Device is down
  BUG: unable to handle page fault for address: ffffffffffffffed
  Call Trace:
   fsnotify+0x54b/0x5c0
   __fsnotify_parent+0x1fe/0x300
   ? vfs_write+0x27c/0x390
   vfs_write+0x27c/0x390
   ksys_write+0x63/0xe0
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

KASAN report:

  BUG: KASAN: use-after-free in digital_send_cmd_complete+0x16/0x50
  Write of size 8 at addr ffff88800a05f720 by task kworker/0:2/71
  Workqueue: events nfcsim_recv_wq [nfcsim]
  Call Trace:
   dump_stack_lvl+0x45/0x59
   print_address_description.constprop.0+0x21/0x140
   ? digital_send_cmd_complete+0x16/0x50
   ? digital_send_cmd_complete+0x16/0x50
   kasan_report.cold+0x7f/0x11b
   ? digital_send_cmd_complete+0x16/0x50
   ? digital_dep_link_down+0x60/0x60
   digital_send_cmd_complete+0x16/0x50
   nfcsim_recv_wq+0x38f/0x3d5 [nfcsim]
   ? nfcsim_in_send_cmd+0x4a/0x4a [nfcsim]
   ? lock_is_held_type+0x98/0x110
   ? finish_wait+0x110/0x110
   ? rcu_read_lock_sched_held+0x9c/0xd0
   ? rcu_read_lock_bh_held+0xb0/0xb0
   ? lockdep_hardirqs_on_prepare+0x12e/0x1f0

This flow of calling digital_send_cmd_complete() callback on driver exit
is specific to nfcsim which implements reading and sending work queues.
Since the NFC digital device was unregistered, the callback should not
be called.

Fixes: 204bddcb508f ("NFC: nfcsim: Make use of the Digital layer")
Cc: 
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: David S. Miller

nfc: s3fwrn5: fix undefined parameter values in dev_err()

2021-07-28T08:23:59+00:00

In the function s3fwrn5_fw_download(), the 'ret' is not assigned,
so the correct value should be given in dev_err function.

Fixes: a0302ff5906a ("nfc: s3fwrn5: remove unnecessary label")
Signed-off-by: Zhang Shengju 
Signed-off-by: Tang Bin 
Reviewed-by: Nathan Chancellor 
Signed-off-by: David S. Miller

nfc: s3fwrn5: fix undefined parameter values in dev_err()

2021-07-27T13:02:11+00:00

In the function s3fwrn5_fw_download(), the 'ret' is not assigned,
so the correct value should be given in dev_err function.

Fixes: a0302ff5906a ("nfc: s3fwrn5: remove unnecessary label")
Signed-off-by: Zhang Shengju 
Signed-off-by: Tang Bin 
Signed-off-by: David S. Miller

NFC: nxp-nci: remove unnecessary label

2021-06-18T19:57:30+00:00

Remove unnecessary label chunk_exit and return directly.

Signed-off-by: wengjianfeng 
Signed-off-by: David S. Miller

NFC: nxp-nci: remove unnecessary labels

2021-06-18T19:08:39+00:00

Simplify the code by removing unnecessary labels and returning directly.

Signed-off-by: wengjianfeng 
Signed-off-by: David S. Miller

nfc: fdp: remove unnecessary labels

2021-06-11T19:50:32+00:00

Some labels are meaningless, so we delete them and use the
return statement instead of the goto statement.

Signed-off-by: wengjianfeng 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: David S. Miller

nfc: mrvl: reduce the scope of local variables

2021-06-03T20:59:08+00:00

In two places the 'ep_desc' and 'skb' local variables are used only
within if() or for() block, so they scope can be reduced which makes the
entire code slightly easier to follow.  No functional change.

Suggested-by: Joe Perches 
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: David S. Miller