linux-stable.git/net/nfc, branch v3.15.2

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11T20:15:36+00:00

Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller

Merge tag 'nfc-next-3.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-next

2014-03-17T17:16:50+00:00

Samuel Ortiz  says:

"NFC: 3.15: First pull request

This is the NFC pull request for 3.15. With this one we have:

- Support for ISO 15693 a.k.a. NFC vicinity a.k.a. Type 5 tags. ISO
  15693 are long range (1 - 2 meters) vicinity tags/cards. The kernel
  now supports those through the NFC netlink and digital APIs.

- Support for TI's trf7970a chipset. This chipset relies on the NFC
  digital layer and the driver currently supports type 2, 4A and 5 tags.

- Support for NXP's pn544 secure firmare download. The pn544 C3 chipsets
  relies on a different firmware download protocal than the C2 one. We
  now support both and use the right one depending on the version we
  detect at runtime.

- Support for 4A tags from the NFC digital layer.

- A bunch of cleanups and minor fixes from Axel Lin and Thierry Escande."

Signed-off-by: John W. Linville

NFC: llcp: Use list_for_each_entry in nfc_llcp_find_local()

2014-03-14T19:19:08+00:00

nfc_llcp_find_local() does not modify any list entry while iterating the list.
So use list_for_each_entry instead of list_for_each_entry_safe.

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: Move checking valid gb_len value to nfc_llcp_set_remote_gb

2014-03-14T19:19:08+00:00

This checking is common for all caller, so move the checking to one place.

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: Remove redundant test for dev->n_targets in nfc_find_target

2014-03-14T19:19:08+00:00

Without this test, it returns NULL if dev->n_targets is 0 anyway.

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: digital: Rename Type V tags to Type 5 tags

2014-03-10T23:40:59+00:00

According to the latest draft specification from
the NFC-V committee, ISO/IEC 15693 tags will be
referred to as "Type 5" tags and not "Type V"
tags anymore.  Make the code reflect the new
terminology.

Signed-off-by: Mark A. Greer 
Signed-off-by: Samuel Ortiz

NFC: Use LIST_HEAD() at appropriate places

2014-02-23T22:34:09+00:00

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: digital: Use matching_[im|tm]_protocols to check with NFC protocols masks

2014-02-23T22:34:09+00:00

This ensures we won't add polling function to the table of polling technologies
for non-supported protocols.

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: Use list_for_each_entry in nfc_find_se()

2014-02-23T22:32:18+00:00

nfc_find_se() does not modify any list entry while iterating the list.
So use list_for_each_entry instead of list_for_each_entry_safe.

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz

NFC: NCI: Use reinit_completion() at appropriate places

2014-02-23T22:32:18+00:00

Calling init_completion() once is enough.
Then use reinit_completion() instead in __nci_request() and nci_spi_send().

Signed-off-by: Axel Lin 
Signed-off-by: Samuel Ortiz