linux-toradex.git/drivers/nfc/st-nci, branch v6.4-rc3

nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition

2023-03-15T07:28:23+00:00

This bug influences both st_nci_i2c_remove and st_nci_spi_remove.
Take st_nci_i2c_remove as an example.

In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work
with llt_ndlc_sm_work.

When it calls ndlc_recv or timeout handler, it will finally call
schedule_work to start the work.

When we call st_nci_i2c_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in ndlc_remove

CPU0                  CPU1

                    |llt_ndlc_sm_work
st_nci_i2c_remove   |
  ndlc_remove       |
     st_nci_remove  |
     nci_free_device|
     kfree(ndev)    |
//free ndlc->ndev   |
                    |llt_ndlc_rcv_queue
                    |nci_recv_frame
                    |//use ndlc->ndev

Fixes: 35630df68d60 ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip")
Signed-off-by: Zheng Wang 
Reviewed-by: Krzysztof Kozlowski 
Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com
Signed-off-by: Jakub Kicinski

nfc: fix memory leak of se_io context in nfc_genl_se_io

2023-02-26T14:55:13+00:00

The callback context for sending/receiving APDUs to/from the selected
secure element is allocated inside nfc_genl_se_io and supposed to be
eventually freed in se_io_cb callback function. However, there are several
error paths where the bwi_timer is not charged to call se_io_cb later, and
the cb_context is leaked.

The patch proposes to free the cb_context explicitly on those error paths.

At the moment we can't simply check 'dev->ops->se_io()' return value as it
may be negative in both cases: when the timer was charged and was not.

Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation")
Reported-by: syzbot+df64c0a2e8d68e78a4fa@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin 
Signed-off-by: Alexey Khoroshilov 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-11-29T21:04:52+00:00

tools/lib/bpf/ringbuf.c
  927cbb478adf ("libbpf: Handle size overflow for ringbuf mmap")
  b486d19a0ab0 ("libbpf: checkpatch: Fixed code alignments in ringbuf.c")
https://lore.kernel.org/all/20221121122707.44d1446a@canb.auug.org.au/

Signed-off-by: Jakub Kicinski

nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION

2022-11-24T04:01:50+00:00

The transaction buffer is allocated by using the size of the packet buf,
and subtracting two which seems intended to remove the two tags which are
not present in the target structure. This calculation leads to under
counting memory because of differences between the packet contents and the
target structure. The aid_len field is a u8 in the packet, but a u32 in
the structure, resulting in at least 3 bytes always being under counted.
Further, the aid data is a variable length field in the packet, but fixed
in the structure, so if this field is less than the max, the difference is
added to the under counting.

To fix, perform validation checks progressively to safely reach the
next field, to determine the size of both buffers and verify both tags.
Once all validation checks pass, allocate the buffer and copy the data.
This eliminates freeing memory on the error path, as validation checks are
moved ahead of memory allocation.

Reported-by: Denis Efremov 
Reviewed-by: Guenter Roeck 
Fixes: 5d1ceb7f5e56 ("NFC: st21nfcb: Add HCI transaction event support")
Signed-off-by: Martin Faltesek 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: Jakub Kicinski

nfc: st-nci: fix memory leaks in EVT_TRANSACTION

2022-11-24T04:01:50+00:00

Error path does not free previously allocated memory. Add devm_kfree() to
the failure path.

Reported-by: Denis Efremov 
Reviewed-by: Guenter Roeck 
Fixes: 5d1ceb7f5e56 ("NFC: st21nfcb: Add HCI transaction event support")
Signed-off-by: Martin Faltesek 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: Jakub Kicinski

nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION

2022-11-24T04:01:50+00:00

The first validation check for EVT_TRANSACTION has two different checks
tied together with logical AND. One is a check for minimum packet length,
and the other is for a valid aid_tag. If either condition is true (fails),
then an error should be triggered. The fix is to change && to ||.

Reported-by: Denis Efremov 
Reviewed-by: Guenter Roeck 
Fixes: 5d1ceb7f5e56 ("NFC: st21nfcb: Add HCI transaction event support")
Signed-off-by: Martin Faltesek 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: Jakub Kicinski

nfc: st-nci: Convert to i2c's .probe_new()

2022-11-23T20:50:08+00:00

The probe function doesn't make use of the i2c_device_id * parameter so it
can be trivially converted.

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Jakub Kicinski

i2c: Make remove callback return void

2022-08-16T10:46:26+00:00

The value returned by an i2c driver's remove function is mostly ignored.
(Only an error message is printed if the value is non-zero that the
error is ignored.)

So change the prototype of the remove function to return no value. This
way driver authors are not tempted to assume that passing an error to
the upper layer is a good idea. All drivers are adapted accordingly.
There is no intended change of behaviour, all callbacks were prepared to
return 0 before.

Reviewed-by: Peter Senna Tschudin 
Reviewed-by: Jeremy Kerr 
Reviewed-by: Benjamin Mugnier 
Reviewed-by: Javier Martinez Canillas 
Reviewed-by: Crt Mori 
Reviewed-by: Heikki Krogerus 
Acked-by: Greg Kroah-Hartman 
Acked-by: Marek Behún  # for leds-turris-omnia
Acked-by: Andy Shevchenko 
Reviewed-by: Petr Machata  # for mlxsw
Reviewed-by: Maximilian Luz  # for surface3_power
Acked-by: Srinivas Pandruvada  # for bmc150-accel-i2c + kxcjk-1013
Reviewed-by: Hans Verkuil  # for media/* + staging/media/*
Acked-by: Miguel Ojeda  # for auxdisplay/ht16k33 + auxdisplay/lcd2s
Reviewed-by: Luca Ceresoli  # for versaclock5
Reviewed-by: Ajay Gupta  # for ucsi_ccg
Acked-by: Jonathan Cameron  # for iio
Acked-by: Peter Rosin  # for i2c-mux-*, max9860
Acked-by: Adrien Grassein  # for lontium-lt8912b
Reviewed-by: Jean Delvare  # for hwmon, i2c-core and i2c/muxes
Acked-by: Corey Minyard  # for IPMI
Reviewed-by: Vladimir Oltean 
Acked-by: Dmitry Torokhov 
Acked-by: Sebastian Reichel  # for drivers/power
Acked-by: Krzysztof Hałasa 
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Wolfram Sang

Merge tag 'spi-remove-void' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

2022-02-28T18:43:07+00:00

Mark Brown says:

====================
spi: Make remove() return void

This series from Uwe Kleine-König converts the spi remove function to
return void since there is nothing useful that we can do with a failure
and it as more buses are converted it'll enable further work on the
driver core.
====================

Link: https://lore.kernel.org/r/20220228173957.1262628-2-broonie@kernel.org/
Signed-off-by: Jakub Kicinski

spi: make remove callback a void function

2022-02-09T13:00:45+00:00

The value returned by an spi driver's remove function is mostly ignored.
(Only an error message is printed if the value is non-zero that the
error is ignored.)

So change the prototype of the remove function to return no value. This
way driver authors are not tempted to assume that passing an error to
the upper layer is a good idea. All drivers are adapted accordingly.
There is no intended change of behaviour, all callbacks were prepared to
return 0 before.

Signed-off-by: Uwe Kleine-König 
Acked-by: Marc Kleine-Budde 
Acked-by: Andy Shevchenko 
Reviewed-by: Geert Uytterhoeven 
Acked-by: Jérôme Pouiller 
Acked-by: Miquel Raynal 
Acked-by: Jonathan Cameron 
Acked-by: Claudius Heine 
Acked-by: Stefan Schmidt 
Acked-by: Alexandre Belloni 
Acked-by: Ulf Hansson  # For MMC
Acked-by: Marcus Folkesson 
Acked-by: Łukasz Stelmach 
Acked-by: Lee Jones 
Link: https://lore.kernel.org/r/20220123175201.34839-6-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown