<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net/nfc/llcp_core.c, branch v4.10</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>NFC: llcp: Use dynamic debug for hex dump</title>
<updated>2016-07-04T10:26:27+00:00</updated>
<author>
<name>Thierry Escande</name>
<email>thierry.escande@collabora.com</email>
</author>
<published>2016-06-07T14:21:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=806bfe31c96f77e917eac476ba87164f7bbd1366'/>
<id>806bfe31c96f77e917eac476ba87164f7bbd1366</id>
<content type='text'>
LLCP skb tx and rx functions now use print_hex_dump_debug() making
these verbose traces controllable using dynamic debug.

Signed-off-by: Thierry Escande &lt;thierry.escande@collabora.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
LLCP skb tx and rx functions now use print_hex_dump_debug() making
these verbose traces controllable using dynamic debug.

Signed-off-by: Thierry Escande &lt;thierry.escande@collabora.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: Pass kern from net_proto_family.create to sk_alloc</title>
<updated>2015-05-11T14:50:17+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2015-05-09T02:09:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=11aa9c28b4209242a9de0a661a7b3405adb568a0'/>
<id>11aa9c28b4209242a9de0a661a7b3405adb568a0</id>
<content type='text'>
In preparation for changing how struct net is refcounted
on kernel sockets pass the knowledge that we are creating
a kernel socket from sock_create_kern through to sk_alloc.

Signed-off-by: "Eric W. Biederman" &lt;ebiederm@xmission.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In preparation for changing how struct net is refcounted
on kernel sockets pass the knowledge that we are creating
a kernel socket from sock_create_kern through to sk_alloc.

Signed-off-by: "Eric W. Biederman" &lt;ebiederm@xmission.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: Fix a memory leak</title>
<updated>2014-11-28T13:07:51+00:00</updated>
<author>
<name>Julien Lefrique</name>
<email>lefrique@marvell.com</email>
</author>
<published>2014-10-21T14:52:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=966efbfb0dc06bc90131ea41aa4be67c0d22853d'/>
<id>966efbfb0dc06bc90131ea41aa4be67c0d22853d</id>
<content type='text'>
Signed-off-by: Julien Lefrique &lt;lefrique@marvell.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Julien Lefrique &lt;lefrique@marvell.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: add __pskb_copy_fclone and pskb_copy_for_clone</title>
<updated>2014-06-11T22:38:02+00:00</updated>
<author>
<name>Octavian Purdila</name>
<email>octavian.purdila@intel.com</email>
</author>
<published>2014-06-11T22:36:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=bad93e9d4eeb0d2d6b79204d6cedc7f2e7b256f1'/>
<id>bad93e9d4eeb0d2d6b79204d6cedc7f2e7b256f1</id>
<content type='text'>
There are several instances where a pskb_copy or __pskb_copy is
immediately followed by an skb_clone.

Add a couple of new functions to allow the copy skb to be allocated
from the fclone cache and thus speed up subsequent skb_clone calls.

Cc: Alexander Smirnov &lt;alex.bluesman.smirnov@gmail.com&gt;
Cc: Dmitry Eremin-Solenikov &lt;dbaryshkov@gmail.com&gt;
Cc: Marek Lindner &lt;mareklindner@neomailbox.ch&gt;
Cc: Simon Wunderlich &lt;sw@simonwunderlich.de&gt;
Cc: Antonio Quartulli &lt;antonio@meshcoding.com&gt;
Cc: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Cc: Gustavo Padovan &lt;gustavo@padovan.org&gt;
Cc: Johan Hedberg &lt;johan.hedberg@gmail.com&gt;
Cc: Arvid Brodin &lt;arvid.brodin@alten.se&gt;
Cc: Patrick McHardy &lt;kaber@trash.net&gt;
Cc: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;
Cc: Jozsef Kadlecsik &lt;kadlec@blackhole.kfki.hu&gt;
Cc: Lauro Ramos Venancio &lt;lauro.venancio@openbossa.org&gt;
Cc: Aloisio Almeida Jr &lt;aloisio.almeida@openbossa.org&gt;
Cc: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
Cc: Jon Maloy &lt;jon.maloy@ericsson.com&gt;
Cc: Allan Stephens &lt;allan.stephens@windriver.com&gt;
Cc: Andrew Hendry &lt;andrew.hendry@gmail.com&gt;
Cc: Eric Dumazet &lt;edumazet@google.com&gt;
Reviewed-by: Christoph Paasch &lt;christoph.paasch@uclouvain.be&gt;
Signed-off-by: Octavian Purdila &lt;octavian.purdila@intel.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There are several instances where a pskb_copy or __pskb_copy is
immediately followed by an skb_clone.

Add a couple of new functions to allow the copy skb to be allocated
from the fclone cache and thus speed up subsequent skb_clone calls.

Cc: Alexander Smirnov &lt;alex.bluesman.smirnov@gmail.com&gt;
Cc: Dmitry Eremin-Solenikov &lt;dbaryshkov@gmail.com&gt;
Cc: Marek Lindner &lt;mareklindner@neomailbox.ch&gt;
Cc: Simon Wunderlich &lt;sw@simonwunderlich.de&gt;
Cc: Antonio Quartulli &lt;antonio@meshcoding.com&gt;
Cc: Marcel Holtmann &lt;marcel@holtmann.org&gt;
Cc: Gustavo Padovan &lt;gustavo@padovan.org&gt;
Cc: Johan Hedberg &lt;johan.hedberg@gmail.com&gt;
Cc: Arvid Brodin &lt;arvid.brodin@alten.se&gt;
Cc: Patrick McHardy &lt;kaber@trash.net&gt;
Cc: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;
Cc: Jozsef Kadlecsik &lt;kadlec@blackhole.kfki.hu&gt;
Cc: Lauro Ramos Venancio &lt;lauro.venancio@openbossa.org&gt;
Cc: Aloisio Almeida Jr &lt;aloisio.almeida@openbossa.org&gt;
Cc: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
Cc: Jon Maloy &lt;jon.maloy@ericsson.com&gt;
Cc: Allan Stephens &lt;allan.stephens@windriver.com&gt;
Cc: Andrew Hendry &lt;andrew.hendry@gmail.com&gt;
Cc: Eric Dumazet &lt;edumazet@google.com&gt;
Reviewed-by: Christoph Paasch &lt;christoph.paasch@uclouvain.be&gt;
Signed-off-by: Octavian Purdila &lt;octavian.purdila@intel.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: Add RAW socket type support for SOCKPROTO_RAW</title>
<updated>2014-05-19T22:06:04+00:00</updated>
<author>
<name>Hiren Tandel</name>
<email>hirent@marvell.com</email>
</author>
<published>2014-05-05T10:43:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=57be1f3f3ec1ccab6432615ca161c4c9ece2a2aa'/>
<id>57be1f3f3ec1ccab6432615ca161c4c9ece2a2aa</id>
<content type='text'>
This allows for a more generic NFC sniffing by using SOCKPROTO_RAW
SOCK_RAW to read RAW NFC frames. This is for sniffing anything but LLCP
(HCI, NCI, etc...).

Signed-off-by: Hiren Tandel &lt;hirent@marvell.com&gt;
Signed-off-by: Rahul Tank &lt;rahult@marvell.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This allows for a more generic NFC sniffing by using SOCKPROTO_RAW
SOCK_RAW to read RAW NFC frames. This is for sniffing anything but LLCP
(HCI, NCI, etc...).

Signed-off-by: Hiren Tandel &lt;hirent@marvell.com&gt;
Signed-off-by: Rahul Tank &lt;rahult@marvell.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: Fix use after free by removing length arg from sk_data_ready callbacks.</title>
<updated>2014-04-11T20:15:36+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2014-04-11T20:15:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=676d23690fb62b5d51ba5d659935e9f7d9da9f8e'/>
<id>676d23690fb62b5d51ba5d659935e9f7d9da9f8e</id>
<content type='text'>
Several spots in the kernel perform a sequence like:

	skb_queue_tail(&amp;sk-&gt;s_receive_queue, skb);
	sk-&gt;sk_data_ready(sk, skb-&gt;len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb-&gt;len access is potentially
to freed up memory.

Furthermore, the skb-&gt;len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Several spots in the kernel perform a sequence like:

	skb_queue_tail(&amp;sk-&gt;s_receive_queue, skb);
	sk-&gt;sk_data_ready(sk, skb-&gt;len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb-&gt;len access is potentially
to freed up memory.

Furthermore, the skb-&gt;len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: llcp: Use list_for_each_entry in nfc_llcp_find_local()</title>
<updated>2014-03-14T19:19:08+00:00</updated>
<author>
<name>Axel Lin</name>
<email>axel.lin@ingics.com</email>
</author>
<published>2014-02-26T02:26:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=29e27dd86b5c4f8e6feb62d7b6a8491539ff1ef1'/>
<id>29e27dd86b5c4f8e6feb62d7b6a8491539ff1ef1</id>
<content type='text'>
nfc_llcp_find_local() does not modify any list entry while iterating the list.
So use list_for_each_entry instead of list_for_each_entry_safe.

Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
nfc_llcp_find_local() does not modify any list entry while iterating the list.
So use list_for_each_entry instead of list_for_each_entry_safe.

Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: Move checking valid gb_len value to nfc_llcp_set_remote_gb</title>
<updated>2014-03-14T19:19:08+00:00</updated>
<author>
<name>Axel Lin</name>
<email>axel.lin@ingics.com</email>
</author>
<published>2014-02-25T01:18:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3143a4ca610d6a3de0d8814ee6f5f7da6fc7fbfa'/>
<id>3143a4ca610d6a3de0d8814ee6f5f7da6fc7fbfa</id>
<content type='text'>
This checking is common for all caller, so move the checking to one place.

Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This checking is common for all caller, so move the checking to one place.

Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: Use LIST_HEAD() at appropriate places</title>
<updated>2014-02-23T22:34:09+00:00</updated>
<author>
<name>Axel Lin</name>
<email>axel.lin@ingics.com</email>
</author>
<published>2014-02-22T14:14:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0b51fc5633df563695f5021bc121a9df20b3eb14'/>
<id>0b51fc5633df563695f5021bc121a9df20b3eb14</id>
<content type='text'>
Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Axel Lin &lt;axel.lin@ingics.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>NFC: llcp: Use default MIU if none was specified on connect</title>
<updated>2014-01-04T02:32:27+00:00</updated>
<author>
<name>Szymon Janc</name>
<email>szymon.janc@gmail.com</email>
</author>
<published>2013-11-30T15:59:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=11bfb1c4b94fe24a83ebeae5c3310280f9606e0e'/>
<id>11bfb1c4b94fe24a83ebeae5c3310280f9606e0e</id>
<content type='text'>
If MIUX is not present in CONNECT or CC use default MIU value (128)
instead of one announced durring link setup.

This was affecting Bluetooth handover with Android 4.3+ NCI stack.

Signed-off-by: Szymon Janc &lt;szymon.janc@gmail.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
If MIUX is not present in CONNECT or CC use default MIU value (128)
instead of one announced durring link setup.

This was affecting Bluetooth handover with Android 4.3+ NCI stack.

Signed-off-by: Szymon Janc &lt;szymon.janc@gmail.com&gt;
Signed-off-by: Samuel Ortiz &lt;sameo@linux.intel.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
