kernel/git/stable/linux.git/net/nfc, branch linux-3.8.y

NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()

2013-05-01T16:46:15+00:00

[ Upstream commit d26d6504f23e803824e8ebd14e52d4fc0a0b09cb ] The code in llcp_sock_recvmsg() does not initialize all the members of struct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it initialize the padding bytes of the structure inserted by the compiler for alignment. Also, if the socket is in state LLCP_CLOSED or is shutting down during receive the msg_namelen member is not updated to 0 while otherwise returning with 0, i.e. "success". The msg_namelen update is also missing for stream and seqpacket sockets which don't fill the sockaddr info. Both issues lead to the fact that the code will leak uninitialized kernel stack bytes in net/socket.c. Fix the first issue by initializing the memory used for sockaddr info with memset(0). Fix the second one by setting msg_namelen to 0 early. It will be updated later if we're going to fill the msg_name member. Signed-off-by: Mathias Krause Cc: Lauro Ramos Venancio Cc: Aloisio Almeida Jr Cc: Samuel Ortiz Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

nfc: remove noisy message from llcp_sock_sendmsg

2012-12-13T17:58:10+00:00

This is easily triggerable when fuzz-testing as an unprivileged user. We could rate-limit it, but given we don't print similar messages for other protocols, I just removed it. Signed-off-by: Dave Jones Signed-off-by: David S. Miller

Merge tag 'nfc-fixes-3.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0

2012-12-06T19:55:57+00:00

This is an NFC LLCP fix for 3.7 and contains only one patch. It fixes a potential crash when receiving an LLCP HDLC frame acking a frame that is not the last sent one. In that case we may dereference an already freed pointer.

NFC: Fix incorrect llcp pointer dereference

2012-11-28T17:42:04+00:00

nfc_llcp_ns(s) dereferences the s pointer which is freed a line above. In a result, it can produce a crash or you will read incorrect value. Signed-off-by: Waldemar Rymarkiewicz Signed-off-by: Samuel Ortiz

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

2012-11-21T17:57:56+00:00

Conflicts: drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c drivers/net/wireless/iwlwifi/pcie/tx.c

NFC: Fix nfc_llcp_local chained list insertion

2012-11-19T23:09:25+00:00

list_add was called with swapped parameters Signed-off-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: Queue a copy of the transmitted LLCP skb

2012-11-19T22:57:01+00:00

Drivers are allowed to modify the sent skb and thus we need to make a copy of it before passing it to the driver. Without this fix, LLCP Tx skbs were not queued properly as the ptype check was failing due to e.g. the pn533 driver skb_pushing the Tx skb. Reported-by: Thierry Escande Signed-off-by: Samuel Ortiz

NFC: Stop sending LLCP frames when tx queues are getting too deep

2012-11-19T22:57:00+00:00

When the tx pending queues and/or the socket tx queue is getting too deep, we have to let userspace know. We won't be queueing any more frames until the congestion is fixed. Signed-off-by: Samuel Ortiz

NFC: Copy user space buffer when sending UI frames

2012-11-19T22:57:00+00:00

Using the userspace IO vector directly is wrong, we should copy it from user space first. Signed-off-by: Samuel Ortiz

NFC: Export nfc_hci_sak_to_protocol()

2012-11-19T22:56:59+00:00

Some HCI drivers will need it. Signed-off-by: Eric Lapuyade Signed-off-by: Samuel Ortiz