linux-toradex.git/net/nfc/nci, branch v3.4.45 Linux kernel for Apalis and Colibri modules NFC: Prevent multiple buffer overflows in NCI 2012-07-16T16:03:50+00:00 Dan Rosenberg dan.j.rosenberg@gmail.com 2012-06-25T14:05:27+00:00 6ee6b4d65c65a006b54b2f8f0aee405b1e01e2b2 commit 67de956ff5dc1d4f321e16cfbd63f5be3b691b43 upstream. Fix multiple remotely-exploitable stack-based buffer overflows due to the NCI code pulling length fields directly from incoming frames and copying too much data into statically-sized arrays. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: security@kernel.org Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org> Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org> Cc: Samuel Ortiz <sameo@linux.intel.com> Cc: David S. Miller <davem@davemloft.net> Acked-by: Ilan Elias <ilane@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 67de956ff5dc1d4f321e16cfbd63f5be3b691b43 upstream.

Fix multiple remotely-exploitable stack-based buffer overflows due to
the NCI code pulling length fields directly from incoming frames and
copying too much data into statically-sized arrays.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: security@kernel.org
Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Ilan Elias <ilane@ti.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
NFC: NCI code identation fixes 2012-03-06T20:16:25+00:00 Samuel Ortiz sameo@linux.intel.com 2012-03-05T00:03:54+00:00 eb9bc6e9a0ac668d2283b8fea1534f8ba31d1692 Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
nfc: NULL vs zero in nci_activate_target() 2012-01-27T19:57:04+00:00 Dan Carpenter dan.carpenter@oracle.com 2012-01-26T06:13:31+00:00 6269cc83e7c444f3050e0d7e640d079bae17aa68 This is a pointer so it should be NULL instead of zero. Sparse complains about this stuff: net/nfc/nci/core.c:447:37: warning: Using plain integer as NULL pointer Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
This is a pointer so it should be NULL instead of zero.  Sparse
complains about this stuff:
net/nfc/nci/core.c:447:37: warning: Using plain integer as NULL pointer

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Add NCI multiple targets support 2012-01-24T19:32:29+00:00 Ilan Elias ilane@ti.com 2012-01-18T11:16:14+00:00 019c4fbaa790e2b3f11dab0c8b7d9896d77db3e5 Add the ability to select between multiple targets in NCI. If only one target is found, it will be auto-activated. If more than one target is found, then DISCOVER_NTF will be generated for each target, and the host should select one by calling DISCOVER_SELECT_CMD. Then, the target will be activated. If the activation fails, GENERIC_ERROR_NTF is generated. Signed-off-by: Ilan Elias <ilane@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Add the ability to select between multiple targets in NCI.
If only one target is found, it will be auto-activated.
If more than one target is found, then DISCOVER_NTF will be
generated for each target, and the host should select one by
calling DISCOVER_SELECT_CMD. Then, the target will be activated.
If the activation fails, GENERIC_ERROR_NTF is generated.

Signed-off-by: Ilan Elias <ilane@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Clearly separate NCI states from flags 2012-01-24T19:32:28+00:00 Ilan Elias ilane@ti.com 2012-01-18T11:16:12+00:00 8939e47fc953cce6ef53e79e9ff9b53319d1a72d Make a clear separation between NCI states and flags. This is required in order to support more NCI states (e.g. for multiple targets support). Signed-off-by: Ilan Elias <ilane@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Make a clear separation between NCI states and flags.
This is required in order to support more NCI states (e.g.
for multiple targets support).

Signed-off-by: Ilan Elias <ilane@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Add NCI data exchange timer 2012-01-24T19:21:55+00:00 Ilan Elias ilane@ti.com 2012-01-17T10:03:50+00:00 c4bf98b220cba7a8618405261d69ee53a265110e Add NCI data exchange timer to catch timeouts, and call the data exchange callback with an error. Signed-off-by: Ilan Elias <ilane@ti.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Add NCI data exchange timer to catch timeouts,
and call the data exchange callback with an error.

Signed-off-by: Ilan Elias <ilane@ti.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Export new attributes sensb_res and sensf_res 2012-01-24T19:21:15+00:00 Ilan Elias ilane@ti.com 2012-01-17T09:06:43+00:00 d5a2ca60e41fec4ede7b82d3608278523cffe77b Export new attributes sensb_res for tech B and sensf_res for tech F in the target info (returned as a response to NFC_CMD_GET_TARGET). The max size of the attributes nfcid1, sensb_res and sensf_res is exported to user space though include/linux/nfc. Signed-off-by: Ilan Elias <ilane@ti.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Export new attributes sensb_res for tech B and sensf_res
for tech F in the target info (returned as a response to
NFC_CMD_GET_TARGET).
The max size of the attributes nfcid1, sensb_res and sensf_res
is exported to user space though include/linux/nfc.

Signed-off-by: Ilan Elias <ilane@ti.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Complete NCI deactivate in deactivate_ntf 2012-01-24T19:08:38+00:00 Ilan Elias ilane@ti.com 2012-01-08T09:21:53+00:00 bd7e01bc7e7a90b33470173618f6f6805143cd42 If a target was active, complete the NCI deactivate request only in deactivate_ntf. Otherwise, complete it at deactivate_rsp. Deactivate_ntf represents the actual disconnection event (sent from the NCI controller). Signed-off-by: Ilan Elias <ilane@ti.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
If a target was active, complete the NCI deactivate request
only in deactivate_ntf. Otherwise, complete it at deactivate_rsp.
Deactivate_ntf represents the actual disconnection event (sent from
the NCI controller).

Signed-off-by: Ilan Elias <ilane@ti.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Export a new attribute nfcid1 in target info 2012-01-04T19:30:43+00:00 Ilan Elias ilane@ti.com 2011-12-22T09:51:54+00:00 288e0713f469c03dbc412153b5341d6dfc2c9907 The nfcid1 is the NFC-A identifier. It is exported as an attribute of the target info (returned as a response to NFC_CMD_GET_TARGET). Signed-off-by: Ilan Elias <ilane@ti.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
The nfcid1 is the NFC-A identifier.
It is exported as an attribute of the target info
(returned as a response to NFC_CMD_GET_TARGET).

Signed-off-by: Ilan Elias <ilane@ti.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
NFC: Handle error during NCI data exchange 2012-01-04T19:30:39+00:00 Ilan Elias ilane@ti.com 2011-12-20T14:57:41+00:00 004161cb52ac49bc17f6528543c1cecbd728f750 Add support for NCI Interface Error Notification. When this notification is received and we're during a data exchange transaction, indicate an error to the NFC core layer via the data exchange callback. Signed-off-by: Ilan Elias <ilane@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
Add support for NCI Interface Error Notification.
When this notification is received and we're during a
data exchange transaction, indicate an error to the NFC
core layer via the data exchange callback.

Signed-off-by: Ilan Elias <ilane@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>