- 26 3月, 2013 1 次提交
-
-
由 Samuel Ortiz 提交于
And avoid decreasing the ack log twice when dequeueing connected LLCP sockets. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 20 3月, 2013 2 次提交
-
-
由 Thierry Escande 提交于
kfree_skb was called twice when the socket receive queue is full Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
Calling sock_orphan when e.g. the NFC adapter is removed can lead to kernel crashes when e.g. a connection less client is sleeping on the Rx workqueue, waiting for data to show up. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 09 3月, 2013 2 次提交
-
-
由 Samuel Ortiz 提交于
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 08 3月, 2013 2 次提交
-
-
由 Samuel Ortiz 提交于
Whenever an adapter is removed we must clean all the local structures, especially the timers and scheduled work. Otherwise those asynchronous threads will eventually try to access the freed nfc_dev pointer if an LLCP link is up. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
This is really difficult to test with real NFC devices, but without this fix an LLCP server will eventually refuse new connections. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 28 2月, 2013 1 次提交
-
-
由 Sasha Levin 提交于
I'm not sure why, but the hlist for each entry iterators were conceived list_for_each_entry(pos, head, member) The hlist ones were greedy and wanted an extra parameter: hlist_for_each_entry(tpos, pos, head, member) Why did they need an extra pos parameter? I'm not quite sure. Not only they don't really need it, it also prevents the iterator from looking exactly like the list iterator, which is unfortunate. Besides the semantic patch, there was some manual work required: - Fix up the actual hlist iterators in linux/list.h - Fix up the declaration of other iterators based on the hlist ones. - A very small amount of places were using the 'node' parameter, this was modified to use 'obj->member' instead. - Coccinelle didn't handle the hlist_for_each_entry_safe iterator properly, so those had to be fixed up manually. The semantic patch which is mostly the work of Peter Senna Tschudin is here: @@ iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host; type T; expression a,c,d,e; identifier b; statement S; @@ -T b; <+... when != b ( hlist_for_each_entry(a, - b, c, d) S | hlist_for_each_entry_continue(a, - b, c) S | hlist_for_each_entry_from(a, - b, c) S | hlist_for_each_entry_rcu(a, - b, c, d) S | hlist_for_each_entry_rcu_bh(a, - b, c, d) S | hlist_for_each_entry_continue_rcu_bh(a, - b, c) S | for_each_busy_worker(a, c, - b, d) S | ax25_uid_for_each(a, - b, c) S | ax25_for_each(a, - b, c) S | inet_bind_bucket_for_each(a, - b, c) S | sctp_for_each_hentry(a, - b, c) S | sk_for_each(a, - b, c) S | sk_for_each_rcu(a, - b, c) S | sk_for_each_from -(a, b) +(a) S + sk_for_each_from(a) S | sk_for_each_safe(a, - b, c, d) S | sk_for_each_bound(a, - b, c) S | hlist_for_each_entry_safe(a, - b, c, d, e) S | hlist_for_each_entry_continue_rcu(a, - b, c) S | nr_neigh_for_each(a, - b, c) S | nr_neigh_for_each_safe(a, - b, c, d) S | nr_node_for_each(a, - b, c) S | nr_node_for_each_safe(a, - b, c, d) S | - for_each_gfn_sp(a, c, d, b) S + for_each_gfn_sp(a, c, d) S | - for_each_gfn_indirect_valid_sp(a, c, d, b) S + for_each_gfn_indirect_valid_sp(a, c, d) S | for_each_host(a, - b, c) S | for_each_host_safe(a, - b, c, d) S | for_each_mesh_entry(a, - b, c, d) S ) ...+> [akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c] [akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c] [akpm@linux-foundation.org: checkpatch fixes] [akpm@linux-foundation.org: fix warnings] [akpm@linux-foudnation.org: redo intrusive kvm changes] Tested-by: NPeter Senna Tschudin <peter.senna@gmail.com> Acked-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: NSasha Levin <sasha.levin@oracle.com> Cc: Wu Fengguang <fengguang.wu@intel.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Gleb Natapov <gleb@redhat.com> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 09 2月, 2013 1 次提交
-
-
由 Dan Carpenter 提交于
If gb_len is less than 3 it would cause an integer underflow and possibly memory corruption in nfc_llcp_parse_gb_tlv(). I removed the old test for gb_len == 0. I also removed the test for ->remote_gb == NULL. It's not possible for ->remote_gb to be NULL and we have already dereferenced ->remote_gb_len so it's too late to test. The old test return -ENODEV but my test returns -EINVAL. Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com> Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
-
- 07 2月, 2013 1 次提交
-
-
由 Michał Mirosław 提交于
All in-kernel users of class_find_device() don't really need mutable data for match callback. In two places (kernel/power/suspend_test.c, drivers/scsi/osd/osd_uld.c) this patch changes match callbacks to use const search data. The const is propagated to rtc_class_open() and power_supply_get_by_name() parameters. Note that there's a dev reference leak in suspend_test.c that's not touched in this patch. Signed-off-by: NMichał Mirosław <mirq-linux@rere.qmqm.pl> Acked-by: NGrant Likely <grant.likely@secretlab.ca> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 11 1月, 2013 2 次提交
-
-
由 Samuel Ortiz 提交于
Safer and more robust than than memcpy_toiovec. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
We can cast msg_name to a sockaddr_nfc_llcp pointer directly. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 10 1月, 2013 9 次提交
-
-
由 Samuel Ortiz 提交于
Each NFC adapter can have several links to different secure elements and that property needs to be exported by the drivers. A secure element link can be enabled and disabled, and card emulation will be handled by the currently active one. Otherwise card emulation will be host implemented. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
Some chips diverge from the HCI spec in their implementation of standard features. This adds a new quirks parameter to nfc_hci_allocate_device() to let the driver indicate its divergence. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
Some chips use a standard HCI event code, destined to a proprietary gate, with a different meaning. Therefore, the HCI driver must always have a chance to intercept the event before standard processing is attempted. The new semantic specifies that the result value "1" means that the driver doesn't especially handle the event. result <= 0 means it was handled. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
There is no use to return an error if the caller doesn't get it. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
When an adapter is removed, it will unregister itself from hci and/or nfc core. In order to do that safely, work tasks must first be canceled and prevented to be scheduled again, before the hci or nfc device can be destroyed. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
The reference count bump on the llcp Rx path is leading to a memory leak whenever we're not receiving an I frame. We fix that by removing the refcount bump (drivers must not free their received skb) and using it only in the I frame path, when the frame is actually queued. In that case, the skb will only be freed when someone fetches it from userspace. in all other cases, LLCP received frames will be freed when leaving the Rx work queue. Reported-by: NEric Lapuyade <eric.lapuyade@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
Not only it was improperly use to queue backlogged RX skbuffs, but it was also not processed at all. If the socket receive queue is full we simply drop the incoming packets. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Thierry Escande 提交于
Set timestamp in sent and received sk_buffs. timestamp is then put in msghdr structure in llcp_sock_recvmsg(). Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 14 12月, 2012 1 次提交
-
-
由 Dave Jones 提交于
This is easily triggerable when fuzz-testing as an unprivileged user. We could rate-limit it, but given we don't print similar messages for other protocols, I just removed it. Signed-off-by: NDave Jones <davej@redhat.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 29 11月, 2012 1 次提交
-
-
由 Waldemar Rymarkiewicz 提交于
nfc_llcp_ns(s) dereferences the s pointer which is freed a line above. In a result, it can produce a crash or you will read incorrect value. Signed-off-by: NWaldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 20 11月, 2012 9 次提交
-
-
由 Thierry Escande 提交于
list_add was called with swapped parameters Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
Drivers are allowed to modify the sent skb and thus we need to make a copy of it before passing it to the driver. Without this fix, LLCP Tx skbs were not queued properly as the ptype check was failing due to e.g. the pn533 driver skb_pushing the Tx skb. Reported-by: NThierry Escande <thierry.escande@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
When the tx pending queues and/or the socket tx queue is getting too deep, we have to let userspace know. We won't be queueing any more frames until the congestion is fixed. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
Using the userspace IO vector directly is wrong, we should copy it from user space first. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
Some HCI drivers will need it. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
A chip with pre-opened gates may send events on a gate that nobody has opened in the handset host. Discard those events. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
NFC_HCI_ID_MGMT_VERSION_SW and NFC_HCI_ID_MGMT_VERSION_HW are optional registers for gate NFC_HCI_ID_MGMT_GATE in standard HCI. When chip doesn't implement, just leave all the information as zeros. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Eric Lapuyade 提交于
In some cases, pre-opened pipes don't stay open when a clear all pipes command is sent. They stay created however. Therefore, one can never assume that such a pipe is already open. As re-opening a pipe seems not to be a problem, we do that now. Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 29 10月, 2012 1 次提交
-
-
由 Thierry Escande 提交于
NFC_CMD_LLC_GET_PARAMS: request LTO, RW, and MIUX parameters for a device NFC_CMD_LLC_SET_PARAMS: set one or more of LTO, RW, and MIUX parameters for a device. LTO must be set before the link is up otherwise -EINPROGRESS is returned. RW and MIUX can be set at anytime and will be passed in subsequent CONNECT and CC messages. If one of the passed parameters is wrong none is set and -EINVAL is returned. Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
- 27 10月, 2012 7 次提交
-
-
由 Samuel Ortiz 提交于
The Tx queues are no longer valid when we receive a disconnection or when the LLCP link goes down. In the later case we also purge the entire local Tx queue. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Kees Cook 提交于
This config item has not carried much meaning for a while now and is almost always enabled by default. As agreed during the Linux kernel summit, remove it. Acked-by: NDavid S. Miller <davem@davemloft.net> Signed-off-by: NKees Cook <keescook@chromium.org> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Kees Cook 提交于
This config item has not carried much meaning for a while now and is almost always enabled by default. As agreed during the Linux kernel summit, remove it. Acked-by: NDavid S. Miller <davem@davemloft.net> Signed-off-by: NKees Cook <keescook@chromium.org> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Kees Cook 提交于
This config item has not carried much meaning for a while now and is almost always enabled by default. As agreed during the Linux kernel summit, remove it. Acked-by: NDavid S. Miller <davem@davemloft.net> Signed-off-by: NKees Cook <keescook@chromium.org> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Szymon Janc 提交于
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com> Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
As a consequence the NFC device IDs won't be increasing all the time, as IDR provides the first available ID. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-
由 Samuel Ortiz 提交于
The previous code was always returning the last socket from the LLCP socket list. Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
-