linux-stable.git/net/nfc, branch v4.1.45

NFC: Add sockaddr length checks before accessing sa_family in bind handlers

2017-09-01T18:24:28+00:00

[ Upstream commit f6a5885fc4d68e7f25ffb42b9d8d80aebb3bacbb ]

Verify that the caller-provided sockaddr structure is large enough to
contain the sa_family field, before accessing it in bind() handlers of the
AF_NFC socket. Since the syscall doesn't enforce a minimum size of the
corresponding memory region, very short sockaddrs (zero or one byte long)
result in operating on uninitialized memory while referencing .sa_family.

Signed-off-by: Mateusz Jurczyk 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin

nfc: Fix the sockaddr length sanitization in llcp_sock_connect

2017-09-01T18:24:28+00:00

[ Upstream commit 608c4adfcabab220142ee335a2a003ccd1c0b25b ]

Fix the sockaddr length verification in the connect() handler of NFC/LLCP
sockets, to compare against the size of the actual structure expected on
input (sockaddr_nfc_llcp) instead of its shorter version (sockaddr_nfc).

Both structures are defined in include/uapi/linux/nfc.h. The fields
specific to the _llcp extended struct are as follows:

   276		__u8 dsap; /* Destination SAP, if known */
   277		__u8 ssap; /* Source SAP to be bound to */
   278		char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */;
   279		size_t service_name_len;

If the caller doesn't provide a sufficiently long sockaddr buffer, these
fields remain uninitialized (and they currently originate from the stack
frame of the top-level sys_connect handler). They are then copied by
llcp_sock_connect() into internal storage (nfc_llcp_sock structure), and
could be subsequently read back through the user-mode getsockname()
function (handled by llcp_sock_getname()). This would result in the
disclosure of up to ~70 uninitialized bytes from the kernel stack to
user-mode clients capable of creating AFC_NFC sockets.

Signed-off-by: Mateusz Jurczyk 
Acked-by: Kees Cook 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin

nfc: Ensure presence of required attributes in the activate_target handler

2017-09-01T18:24:27+00:00

[ Upstream commit a0323b979f81ad2deb2c8836eab506534891876a ]

Check that the NFC_ATTR_TARGET_INDEX and NFC_ATTR_PROTOCOLS attributes (in
addition to NFC_ATTR_DEVICE_INDEX) are provided by the netlink client
prior to accessing them. This prevents potential unhandled NULL pointer
dereference exceptions which can be triggered by malicious user-mode
programs, if they omit one or both of these attributes.

Signed-off-by: Mateusz Jurczyk 
Acked-by: Kees Cook 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin

NFC: fix broken device allocation

2017-09-01T18:24:27+00:00

[ Upstream commit 20777bc57c346b6994f465e0d8261a7fbf213a09 ]

Commit 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs")
moved device-id allocation and struct-device initialisation from
nfc_allocate_device() to nfc_register_device().

This broke just about every nfc-device-registration error path, which
continue to call nfc_free_device() that tries to put the device
reference of the now uninitialised (but zeroed) struct device:

kobject: '(null)' (ce316420): is not initialized, yet kobject_put() is being called.

The late struct-device initialisation also meant that various work
queues whose names are derived from the nfc device name were also
misnamed:

  421 root         0 SW<  [(null)_nci_cmd_]
  422 root         0 SW<  [(null)_nci_rx_w]
  423 root         0 SW<  [(null)_nci_tx_w]

Move the id-allocation and struct-device initialisation back to
nfc_allocate_device() and fix up the single call site which did not use
nfc_free_device() in its error path.

Fixes: 7eda8b8e9677 ("NFC: Use IDR library to assing NFC devices IDs")
Cc: stable      # 3.8
Cc: Samuel Ortiz 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin

NFC: nci: extract pipe value using NCI_HCP_MSG_GET_PIPE

2015-12-09T19:03:20+00:00

commit e65917b6d54f8b47d8293ea96adfa604fd46cf0d upstream.

When receiving data in nci_hci_msg_rx_work, extract pipe
value using NCI_HCP_MSG_GET_PIPE macro.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nci: Fix improper management of HCI return code

2015-12-09T19:03:19+00:00

commit d8cd37ed2fc871c66b4c79c59f651dc2cdf7091c upstream.

When sending HCI data over NCI, HCI return code is part
of the NCI data. In order to get correctly the HCI return
code, we assume the NCI communication is successful and
extract the return code for the nci_hci functions return code.

This is done because nci_to_errno does not match hci return
code value.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nci: Fix incorrect data chaining when sending data

2015-12-09T19:03:19+00:00

commit 500c4ef02277eaadbfe20537f963b6221f6ac007 upstream.

When sending HCI data over NCI, cmd information should be
present only on the first packet.
Each packet shall be specifically allocated and sent to the
NCI layer.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

nfc: nci: hci: Add check on skb nci_hci_send_cmd parameter

2015-09-29T17:25:55+00:00

commit 5a9e0ffc0f128ecdf7c770f76c268e4f9f3c9118 upstream.

skb can be NULL and may lead to a NULL pointer error.

Add a check condition before setting HCI rx buffer.

Signed-off-by: Christophe Ricard 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

nfc: Fix portid type in urelease_work

2015-04-13T20:35:16+00:00

portid is an unsigned integer. Fix urelease_work to
match all other portid user in the kernel.

Signed-off-by: Richard Weinberger 
Signed-off-by: David S. Miller

NFC: nci: Add firmware download support

2015-03-26T09:56:20+00:00

A simple forward for firmware download (i.e. sending a new firmware
to the NFC adapter) from the NFC subsystem to the drivers.

This feature is required to update the firmware of NXP-NCI NFC
controllers but can be used by any NCI driver.

This feature has been present in the HCI subsystem since 9a695d.

Signed-off-by: Clément Perrochaud 
Signed-off-by: Samuel Ortiz