linux.git/net/nfc/llcp, branch v3.5

NFC: Prevent NULL deref when getting socket name

2012-07-09T19:01:00+00:00

llcp_sock_getname can be called without a device attached to the nfc_llcp_sock.

This would lead to the following BUG:

[  362.341807] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  362.341815] IP: [] llcp_sock_getname+0x75/0xc0
[  362.341818] PGD 31b35067 PUD 30631067 PMD 0
[  362.341821] Oops: 0000 [#627] PREEMPT SMP DEBUG_PAGEALLOC
[  362.341826] CPU 3
[  362.341827] Pid: 7816, comm: trinity-child55 Tainted: G      D W    3.5.0-rc4-next-20120628-sasha-00005-g9f23eb7 #479
[  362.341831] RIP: 0010:[]  [] llcp_sock_getname+0x75/0xc0
[  362.341832] RSP: 0018:ffff8800304fde88  EFLAGS: 00010286
[  362.341834] RAX: 0000000000000000 RBX: ffff880033cb8000 RCX: 0000000000000001
[  362.341835] RDX: ffff8800304fdec4 RSI: ffff8800304fdec8 RDI: ffff8800304fdeda
[  362.341836] RBP: ffff8800304fdea8 R08: 7ebcebcb772b7ffb R09: 5fbfcb9c35bdfd53
[  362.341838] R10: 4220020c54326244 R11: 0000000000000246 R12: ffff8800304fdec8
[  362.341839] R13: ffff8800304fdec4 R14: ffff8800304fdec8 R15: 0000000000000044
[  362.341841] FS:  00007effa376e700(0000) GS:ffff880035a00000(0000) knlGS:0000000000000000
[  362.341843] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  362.341844] CR2: 0000000000000000 CR3: 0000000030438000 CR4: 00000000000406e0
[  362.341851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  362.341856] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  362.341858] Process trinity-child55 (pid: 7816, threadinfo ffff8800304fc000, task ffff880031270000)
[  362.341858] Stack:
[  362.341862]  ffff8800304fdea8 ffff880035156780 0000000000000000 0000000000001000
[  362.341865]  ffff8800304fdf78 ffffffff83183b40 00000000304fdec8 0000006000000000
[  362.341868]  ffff8800304f0027 ffffffff83729649 ffff8800304fdee8 ffff8800304fdf48
[  362.341869] Call Trace:
[  362.341874]  [] sys_getpeername+0xa0/0x110
[  362.341877]  [] ? _raw_spin_unlock_irq+0x59/0x80
[  362.341882]  [] ? do_setitimer+0x23b/0x290
[  362.341886]  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
[  362.341889]  [] system_call_fastpath+0x16/0x1b
[  362.341921] Code: 84 00 00 00 00 00 b8 b3 ff ff ff 48 85 db 74 54 66 41 c7 04 24 27 00 49 8d 7c 24 12 41 c7 45 00 60 00 00 00 48 8b 83 28 05 00 00 <8b> 00 41 89 44 24 04 0f b6 83 41 05 00 00 41 88 44 24 10 0f b6
[  362.341924] RIP  [] llcp_sock_getname+0x75/0xc0
[  362.341925]  RSP 
[  362.341926] CR2: 0000000000000000
[  362.341928] ---[ end trace 6d450e935ee18bf3 ]---

Signed-off-by: Sasha Levin 
Signed-off-by: John W. Linville

NFC: Fix possible NULL ptr deref when getting the name of a socket

2012-06-08T17:47:07+00:00

llcp_sock_getname() might get called before the LLCP socket was created.
This condition isn't checked, and llcp_sock_getname will simply deref a
NULL ptr in that case.

This exists starting with d646960 ("NFC: Initial LLCP support").

Signed-off-by: Sasha Levin 
Signed-off-by: John W. Linville

NFC: Queue I frame fragments to the LLCP sockets queue tail

2012-05-16T17:08:14+00:00

After testing our stack with large SNEP messages, we realized the fragments
were arriving in reversed order.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Return the amount of LLCP bytes queued to sock_sendmsg

2012-05-15T21:28:02+00:00

Otherwise an LLCP send() always returns 0.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Update the LLCP poll mask

2012-05-15T21:28:02+00:00

Fix the poll mask depending on the socket state. POLLOUT was missing
for example.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: LLCP connect must wait for a CC frame

2012-05-15T21:28:01+00:00

Blocking sockets should sleep on a CC (Connection Complete) reception
from the connect() call.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Fix LLCP link timeout typo

2012-04-12T19:10:45+00:00

We were sending the LTO TLV as a version TLV instead of the actual link
timeout one.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Add MIUX to the local LLCP general bytes

2012-04-12T19:10:44+00:00

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Call llcp_add_header properly when sending LLCP DM or DISC

2012-04-12T19:10:42+00:00

dsap and ssap were swapped when sending DN or DISC.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville

NFC: Fix LLCP TLV building routine

2012-04-12T19:10:41+00:00

The if logic could lead to zero length TLVs.

Signed-off-by: Samuel Ortiz 
Signed-off-by: John W. Linville