linux-toradex.git/drivers/nfc, branch v4.9.70

nfc: fdp: fix NULL pointer dereference

2017-08-07T01:59:42+00:00

commit b6355fb3f5f40bbce165847d277e64896cab8f95 upstream.

We are checking phy after dereferencing it. We can print the debug
information after checking it. If phy is NULL then we will get a good
stack trace to tell us that we are in this irq handler.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

nfc: Fix hangup of RC-S380* in port100_send_ack()

2017-08-07T01:59:41+00:00

commit 2497128133f8169b24b928852ba6eae34fc495e5 upstream.

If port100_send_ack() was called twice or more, it has race to hangup.

  port100_send_ack()          port100_send_ack()
    init_completion()
    [...]
    dev->cmd_cancel = true
                                /* this removes previous from completion */
                                init_completion()
				[...]
                                dev->cmd_cancel = true
                                wait_for_completion()
    /* never be waked up */
    wait_for_completion()

Like above race, this code is not assuming port100_send_ack() is
called twice or more.

To fix, this checks dev->cmd_cancel to know if prior cancel is
in-flight or not. And never be remove prior task from completion by
using reinit_completion(), so this guarantees to be waked up properly
soon or later.

Signed-off-by: OGAWA Hirofumi 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: fix firmware-management initialisation

2017-07-27T22:07:56+00:00

commit 45dd39b974f6632222dd5cdcbea7358a077ab0b0 upstream.

The nci-device was never deregistered in the event that
fw-initialisation failed.

Fix this by moving the firmware initialisation before device
registration since the firmware work queue should be available before
registering.

Note that this depends on a recent fix that moved device-name
initialisation back to to nci_allocate_device() as the
firmware-workqueue name is now derived from the nfc-device name.

Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: use nfc-device for firmware download

2017-07-27T22:07:56+00:00

commit e5834ac22948169bbd7c45996d8d4905edd20f5e upstream.

Use the nfc- rather than phy-device in firmware-management code that
needs a valid struct device.

This specifically fixes a NULL-pointer dereference in
nfcmrvl_fw_dnld_init() during registration when the underlying tty is
one end of a Unix98 pty.

Note that the driver still uses the phy device for any debugging, which
is fine for now.

Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: do not use device-managed resources

2017-07-27T22:07:56+00:00

commit 0cbe40112f42cf5e008f9127f6cd5952ba3946c7 upstream.

This specifically fixes resource leaks in the registration error paths.

Device-managed resources is a bad fit for this driver as devices can be
registered from the n_nci line discipline. Firstly, a tty may not even
have a corresponding device (should it be part of a Unix98 pty)
something which would lead to a NULL-pointer dereference when
registering resources.

Secondly, if the tty has a class device, its lifetime exceeds that of
the line discipline, which means that resources would leak every time
the line discipline is closed (or if registration fails).

Currently, the devres interface was only being used to request a reset
gpio despite the fact that it was already explicitly freed in
nfcmrvl_nci_unregister_dev() (along with the private data), something
which also prevented the resource leak at close.

Note that the driver treats gpio number 0 as invalid despite it being
perfectly valid. This will be addressed in a follow-up patch.

Fixes: b2fe288eac72 ("NFC: nfcmrvl: free reset gpio")
Fixes: 4a2b947f56b3 ("NFC: nfcmrvl: add chip reset management")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl_uart: add missing tty-device sanity check

2017-07-27T22:07:56+00:00

commit 15e0c59f1535926a939d1df66d6edcf997d7c1b9 upstream.

Make sure to check the tty-device pointer before trying to access the
parent device to avoid dereferencing a NULL-pointer when the tty is one
end of a Unix98 pty.

Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

mei: bus: fix received data size check in NFC fixup

2016-10-31T16:25:22+00:00

NFC version reply size checked against only header size, not against
full message size. That may lead potentially to uninitialized memory access
in version data.

That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]:  => 212:2

Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57

Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'nfc-next-4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-next

2016-07-21T06:39:36+00:00

Samuel Ortiz says:

====================
NFC 4.8 pull request

This is the first NFC pull request for 4.8. We have:

- A fairly large NFC digital stack patchset:
  * RTOX fixes.
  * Proper DEP RWT support.
  * ACK and NACK PDUs handling fixes, in both initiator
    and target modes.
  * A few memory leak fixes.

- A conversion of the nfcsim driver to use the digital stack.
  The driver supports the DEP protocol in both NFC-A and NFC-F.

- Error injection through debugfs for the nfcsim driver.

- Improvements to the port100 driver for the Sony USB chipset, in
  particular to the command abort and cancellation code paths.

- A few minor fixes for the pn533, trf7970a and fdp drivers.
====================

Signed-off-by: David S. Miller

NFC: nfcsim: Simulate lost frames through debugfs entry

2016-07-19T21:24:49+00:00

This patch allows to simulate the lost of frames exchanged between the 2
nfcsim devices through a control entry in the debugfs and is used as
follow:

 echo n > /sys/kernel/debug/nfcsim/nfcX/dropframe

Where n specifies the number of frames to be dropped between 0 and 255
and nfcX is either nfc0 or nfc1, one of the two nfcsim devices.

In the following example, the next frame that should be sent by the nfc0
device will be dropped and thus not received by the nfc1 device:

 echo 1 > /sys/kernel/debug/nfcsim/nfc0/dropframe

The value of 0 can be used to reset the dropframe counter.

Signed-off-by: Thierry Escande 
Signed-off-by: Samuel Ortiz

NFC: nfcsim: Add support for sysfs control entry

2016-07-19T21:23:29+00:00

The idea is to have a way to control and/or modify the behavior of the
nfcsim virtual devices.

This patch creates a folder tree in the debug filesystem. The debugfs is
usually mounted into /sys/kernel/debug and the nfcsim entries are
located in DEBUGFS/nfcsim/nfcX/ where X is either 0 or 1 depending on
the device you want to address.

These folders are empty for now and control entries will be added by
upcoming commits.

Signed-off-by: Thierry Escande 
Signed-off-by: Samuel Ortiz