Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0bb9b39 authored by John W. Linville's avatar John W. Linville
Browse files

Merge tag 'nfc-fixes-3.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-fixes 



Samuel Ortiz <sameo@linux.intel.com> says:

"This is the 2nd batch of NFC fixes for 3.9. This time we have:

- A crash fix for when a DGRAM LLCP socket is listening while the NFC adapter
  is physically removed.
- A potential double skb free when the LLCP socket receive queue is full.
- A fix for properly handling multiple and consecutive LLCP connections, and
  not trash the socket ack log.
- A build failure for the MEI microread physical layer, now that the MEI bus
  APIs have been merged into char-misc-next."

Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parents 2206c3ab 9593b0b1

drivers/nfc/microread/mei.c

+17 −21
Original line number Original line Diff line number Diff line
@@ -22,7 +22,7 @@ 
#include <linux/slab.h>

#include <linux/slab.h>

#include <linux/interrupt.h>

#include <linux/interrupt.h>

#include <linux/gpio.h>

#include <linux/gpio.h>

#include <linux/mei_bus.h>

#include <linux/mei_cl_bus.h>





#include <linux/nfc.h>

#include <linux/nfc.h>

#include <net/nfc/hci.h>

#include <net/nfc/hci.h>
@@ -32,9 +32,6 @@ 




#define MICROREAD_DRIVER_NAME "microread"

#define MICROREAD_DRIVER_NAME "microread"





#define MICROREAD_UUID UUID_LE(0x0bb17a78, 0x2a8e, 0x4c50, 0x94, \

			       0xd4, 0x50, 0x26, 0x67, 0x23, 0x77, 0x5c)



struct mei_nfc_hdr {

struct mei_nfc_hdr {

	u8 cmd;

	u8 cmd;

	u8 status;

	u8 status;
@@ -48,7 +45,7 @@ struct mei_nfc_hdr { 
#define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)

#define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)





struct microread_mei_phy {

struct microread_mei_phy {

	struct mei_device *mei_device;

	struct mei_cl_device *device;

	struct nfc_hci_dev *hdev;

	struct nfc_hci_dev *hdev;





	int powered;

	int powered;
@@ -105,14 +102,14 @@ static int microread_mei_write(void *phy_id, struct sk_buff *skb) 




	MEI_DUMP_SKB_OUT("mei frame sent", skb);

	MEI_DUMP_SKB_OUT("mei frame sent", skb);





	r = mei_send(phy->device, skb->data, skb->len);

	r = mei_cl_send(phy->device, skb->data, skb->len);

	if (r > 0)

	if (r > 0)

		r = 0;

		r = 0;





	return r;

	return r;

}

}





static void microread_event_cb(struct mei_device *device, u32 events,

static void microread_event_cb(struct mei_cl_device *device, u32 events,

			       void *context)

			       void *context)

{

{

	struct microread_mei_phy *phy = context;

	struct microread_mei_phy *phy = context;
@@ -120,7 +117,7 @@ static void microread_event_cb(struct mei_device *device, u32 events, 
	if (phy->hard_fault != 0)

	if (phy->hard_fault != 0)

		return;

		return;





	if (events & BIT(MEI_EVENT_RX)) {

	if (events & BIT(MEI_CL_EVENT_RX)) {

		struct sk_buff *skb;

		struct sk_buff *skb;

		int reply_size;

		int reply_size;
@@ -128,7 +125,7 @@ static void microread_event_cb(struct mei_device *device, u32 events, 
		if (!skb)

		if (!skb)

			return;

			return;





		reply_size = mei_recv(device, skb->data, MEI_NFC_MAX_READ);

		reply_size = mei_cl_recv(device, skb->data, MEI_NFC_MAX_READ);

		if (reply_size < MEI_NFC_HEADER_SIZE) {

		if (reply_size < MEI_NFC_HEADER_SIZE) {

			kfree(skb);

			kfree(skb);

			return;

			return;
@@ -149,8 +146,8 @@ static struct nfc_phy_ops mei_phy_ops = { 
	.disable = microread_mei_disable,

	.disable = microread_mei_disable,

};

};





static int microread_mei_probe(struct mei_device *device,

static int microread_mei_probe(struct mei_cl_device *device,

			       const struct mei_id *id)

			       const struct mei_cl_device_id *id)

{

{

	struct microread_mei_phy *phy;

	struct microread_mei_phy *phy;

	int r;

	int r;
@@ -164,9 +161,9 @@ static int microread_mei_probe(struct mei_device *device, 
	}

	}





	phy->device = device;

	phy->device = device;

	mei_set_clientdata(device, phy);

	mei_cl_set_drvdata(device, phy);





	r = mei_register_event_cb(device, microread_event_cb, phy);

	r = mei_cl_register_event_cb(device, microread_event_cb, phy);

	if (r) {

	if (r) {

		pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");

		pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");

		goto err_out;

		goto err_out;
@@ -186,9 +183,9 @@ err_out: 
	return r;

	return r;

}

}





static int microread_mei_remove(struct mei_device *device)

static int microread_mei_remove(struct mei_cl_device *device)

{

{

	struct microread_mei_phy *phy = mei_get_clientdata(device);

	struct microread_mei_phy *phy = mei_cl_get_drvdata(device);





	pr_info("Removing microread\n");

	pr_info("Removing microread\n");
@@ -202,16 +199,15 @@ static int microread_mei_remove(struct mei_device *device) 
	return 0;

	return 0;

}

}





static struct mei_id microread_mei_tbl[] = {

static struct mei_cl_device_id microread_mei_tbl[] = {

	{ MICROREAD_DRIVER_NAME, MICROREAD_UUID },

	{ MICROREAD_DRIVER_NAME },





	/* required last entry */

	/* required last entry */

	{ }

	{ }

};

};



MODULE_DEVICE_TABLE(mei, microread_mei_tbl);

MODULE_DEVICE_TABLE(mei, microread_mei_tbl);





static struct mei_driver microread_driver = {

static struct mei_cl_driver microread_driver = {

	.id_table = microread_mei_tbl,

	.id_table = microread_mei_tbl,

	.name = MICROREAD_DRIVER_NAME,

	.name = MICROREAD_DRIVER_NAME,
@@ -225,7 +221,7 @@ static int microread_mei_init(void) 




	pr_debug(DRIVER_DESC ": %s\n", __func__);

	pr_debug(DRIVER_DESC ": %s\n", __func__);





	r = mei_driver_register(&microread_driver);

	r = mei_cl_driver_register(&microread_driver);

	if (r) {

	if (r) {

		pr_err(MICROREAD_DRIVER_NAME ": driver registration failed\n");

		pr_err(MICROREAD_DRIVER_NAME ": driver registration failed\n");

		return r;

		return r;
@@ -236,7 +232,7 @@ static int microread_mei_init(void) 




static void microread_mei_exit(void)

static void microread_mei_exit(void)

{

{

	mei_driver_unregister(&microread_driver);

	mei_cl_driver_unregister(&microread_driver);

}

}





module_init(microread_mei_init);

module_init(microread_mei_init);

net/nfc/llcp/llcp.c

+0 −8
Original line number Original line Diff line number Diff line
@@ -107,8 +107,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen, 
				accept_sk->sk_state_change(sk);

				accept_sk->sk_state_change(sk);





				bh_unlock_sock(accept_sk);

				bh_unlock_sock(accept_sk);



				sock_orphan(accept_sk);

			}

			}





			if (listen == true) {

			if (listen == true) {
@@ -134,8 +132,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen, 




		bh_unlock_sock(sk);

		bh_unlock_sock(sk);





		sock_orphan(sk);



		sk_del_node_init(sk);

		sk_del_node_init(sk);

	}

	}
@@ -164,8 +160,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen, 




		bh_unlock_sock(sk);

		bh_unlock_sock(sk);





		sock_orphan(sk);



		sk_del_node_init(sk);

		sk_del_node_init(sk);

	}

	}
@@ -827,7 +821,6 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local, 
		skb_get(skb);

		skb_get(skb);

	} else {

	} else {

		pr_err("Receive queue is full\n");

		pr_err("Receive queue is full\n");

		kfree_skb(skb);

	}

	}





	nfc_llcp_sock_put(llcp_sock);

	nfc_llcp_sock_put(llcp_sock);
@@ -1028,7 +1021,6 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local, 
			skb_get(skb);

			skb_get(skb);

		} else {

		} else {

			pr_err("Receive queue is full\n");

			pr_err("Receive queue is full\n");

			kfree_skb(skb);

		}

		}

	}

	}

net/nfc/llcp/sock.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -270,7 +270,9 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent, 
		}

		}





		if (sk->sk_state == LLCP_CONNECTED || !newsock) {

		if (sk->sk_state == LLCP_CONNECTED || !newsock) {

			nfc_llcp_accept_unlink(sk);

			list_del_init(&lsk->accept_queue);

			sock_put(sk);



			if (newsock)

			if (newsock)

				sock_graft(sk, newsock);

				sock_graft(sk, newsock);
@@ -464,8 +466,6 @@ static int llcp_sock_release(struct socket *sock) 
			nfc_llcp_accept_unlink(accept_sk);

			nfc_llcp_accept_unlink(accept_sk);





			release_sock(accept_sk);

			release_sock(accept_sk);



			sock_orphan(accept_sk);

		}

		}

	}

	}