linux-toradex.git/drivers/nfc, branch v4.9.96

NFC: pn533: change order of free_irq and dev unregistration

2018-03-22T08:17:46+00:00

[ Upstream commit 068a496c4525c638ffab56449d905b88ef97fe32 ]

Change order of free_irq and dev unregistration.
It fixes situation when device already unregistered and
an interrupt happens and nobody can handle it.

Signed-off-by: Andrey Rusalin 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: double free on error path

2018-03-22T08:17:46+00:00

[ Upstream commit ca42fb9e52d155547e6cf18cf26bce3e1a6af4ea ]

The nci_spi_send() function calls kfree_skb(skb) on both error and
success so this extra kfree_skb() is a double free.

Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by: Dan Carpenter 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: Include unaligned.h instead of access_ok.h

2018-03-22T08:17:45+00:00

[ Upstream commit d916d923724d59cde99ee588f15eec59dd863bbd ]

Including linux/unaligned/access_ok.h causes the allmodconfig build on
ia64 (and maybe others) to fail with the following warnings:

include/linux/unaligned/access_ok.h:7:19: error: redefinition of 'get_unaligned_le16'
include/linux/unaligned/access_ok.h:12:19: error: redefinition of 'get_unaligned_le32'
include/linux/unaligned/access_ok.h:17:19: error: redefinition of 'get_unaligned_le64'
include/linux/unaligned/access_ok.h:22:19: error: redefinition of 'get_unaligned_be16'
include/linux/unaligned/access_ok.h:27:19: error: redefinition of 'get_unaligned_be32'
include/linux/unaligned/access_ok.h:32:19: error: redefinition of 'get_unaligned_be64'
include/linux/unaligned/access_ok.h:37:20: error: redefinition of 'put_unaligned_le16'
include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le32'
include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le64'
include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be16'
include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be32'
include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be64'

Fix these by including asm/unaligned.h instead and leave it up to the
architecture to decide how to implement unaligned accesses.

Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Reported-by: kbuild test robot 
Link: https://lkml.org/lkml/2016/10/22/247
Cc: Vincent Cuissard 
Signed-off-by: Tobias Klauser 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

nfc: fdp: fix NULL pointer dereference

2017-08-07T01:59:42+00:00

commit b6355fb3f5f40bbce165847d277e64896cab8f95 upstream.

We are checking phy after dereferencing it. We can print the debug
information after checking it. If phy is NULL then we will get a good
stack trace to tell us that we are in this irq handler.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

nfc: Fix hangup of RC-S380* in port100_send_ack()

2017-08-07T01:59:41+00:00

commit 2497128133f8169b24b928852ba6eae34fc495e5 upstream.

If port100_send_ack() was called twice or more, it has race to hangup.

  port100_send_ack()          port100_send_ack()
    init_completion()
    [...]
    dev->cmd_cancel = true
                                /* this removes previous from completion */
                                init_completion()
				[...]
                                dev->cmd_cancel = true
                                wait_for_completion()
    /* never be waked up */
    wait_for_completion()

Like above race, this code is not assuming port100_send_ack() is
called twice or more.

To fix, this checks dev->cmd_cancel to know if prior cancel is
in-flight or not. And never be remove prior task from completion by
using reinit_completion(), so this guarantees to be waked up properly
soon or later.

Signed-off-by: OGAWA Hirofumi 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Amit Pundir 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: fix firmware-management initialisation

2017-07-27T22:07:56+00:00

commit 45dd39b974f6632222dd5cdcbea7358a077ab0b0 upstream.

The nci-device was never deregistered in the event that
fw-initialisation failed.

Fix this by moving the firmware initialisation before device
registration since the firmware work queue should be available before
registering.

Note that this depends on a recent fix that moved device-name
initialisation back to to nci_allocate_device() as the
firmware-workqueue name is now derived from the nfc-device name.

Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: use nfc-device for firmware download

2017-07-27T22:07:56+00:00

commit e5834ac22948169bbd7c45996d8d4905edd20f5e upstream.

Use the nfc- rather than phy-device in firmware-management code that
needs a valid struct device.

This specifically fixes a NULL-pointer dereference in
nfcmrvl_fw_dnld_init() during registration when the underlying tty is
one end of a Unix98 pty.

Note that the driver still uses the phy device for any debugging, which
is fine for now.

Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl: do not use device-managed resources

2017-07-27T22:07:56+00:00

commit 0cbe40112f42cf5e008f9127f6cd5952ba3946c7 upstream.

This specifically fixes resource leaks in the registration error paths.

Device-managed resources is a bad fit for this driver as devices can be
registered from the n_nci line discipline. Firstly, a tty may not even
have a corresponding device (should it be part of a Unix98 pty)
something which would lead to a NULL-pointer dereference when
registering resources.

Secondly, if the tty has a class device, its lifetime exceeds that of
the line discipline, which means that resources would leak every time
the line discipline is closed (or if registration fails).

Currently, the devres interface was only being used to request a reset
gpio despite the fact that it was already explicitly freed in
nfcmrvl_nci_unregister_dev() (along with the private data), something
which also prevented the resource leak at close.

Note that the driver treats gpio number 0 as invalid despite it being
perfectly valid. This will be addressed in a follow-up patch.

Fixes: b2fe288eac72 ("NFC: nfcmrvl: free reset gpio")
Fixes: 4a2b947f56b3 ("NFC: nfcmrvl: add chip reset management")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

NFC: nfcmrvl_uart: add missing tty-device sanity check

2017-07-27T22:07:56+00:00

commit 15e0c59f1535926a939d1df66d6edcf997d7c1b9 upstream.

Make sure to check the tty-device pointer before trying to access the
parent device to avoid dereferencing a NULL-pointer when the tty is one
end of a Unix98 pty.

Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
Cc: Vincent Cuissard 
Signed-off-by: Johan Hovold 
Signed-off-by: Samuel Ortiz 
Signed-off-by: Greg Kroah-Hartman

mei: bus: fix received data size check in NFC fixup

2016-10-31T16:25:22+00:00

NFC version reply size checked against only header size, not against
full message size. That may lead potentially to uninitialized memory access
in version data.

That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]:  => 212:2

Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57

Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman