2019-05-19 13:51:43 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2011-12-14 15:43:12 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2011 Intel Corporation. All rights reserved.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#define pr_fmt(fmt) "llcp: %s: " fmt, __func__
|
|
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
|
#include <linux/nfc.h>
|
|
|
|
|
|
|
|
|
|
#include <net/nfc/nfc.h>
|
|
|
|
|
|
2013-04-26 09:49:40 +00:00
|
|
|
#include "nfc.h"
|
2011-12-14 15:43:12 +00:00
|
|
|
#include "llcp.h"
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static const u8 llcp_tlv_length[LLCP_TLV_MAX] = {
|
2011-12-14 15:43:12 +00:00
|
|
|
0,
|
|
|
|
|
1, /* VERSION */
|
|
|
|
|
2, /* MIUX */
|
|
|
|
|
2, /* WKS */
|
|
|
|
|
1, /* LTO */
|
|
|
|
|
1, /* RW */
|
|
|
|
|
0, /* SN */
|
|
|
|
|
1, /* OPT */
|
|
|
|
|
0, /* SDREQ */
|
|
|
|
|
2, /* SDRES */
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u8 llcp_tlv8(const u8 *tlv, u8 type)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
return tlv[2];
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u16 llcp_tlv16(const u8 *tlv, u8 type)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
return be16_to_cpu(*((__be16 *)(tlv + 2)));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u8 llcp_tlv_version(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
return llcp_tlv8(tlv, LLCP_TLV_VERSION);
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u16 llcp_tlv_miux(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
2012-05-14 15:38:54 +00:00
|
|
|
return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff;
|
2011-12-14 15:43:12 +00:00
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u16 llcp_tlv_wks(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
return llcp_tlv16(tlv, LLCP_TLV_WKS);
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u16 llcp_tlv_lto(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
return llcp_tlv8(tlv, LLCP_TLV_LTO);
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u8 llcp_tlv_opt(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
return llcp_tlv8(tlv, LLCP_TLV_OPT);
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static u8 llcp_tlv_rw(const u8 *tlv)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
return llcp_tlv8(tlv, LLCP_TLV_RW) & 0xf;
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
u8 *tlv, length;
|
|
|
|
|
|
|
|
|
|
pr_debug("type %d\n", type);
|
|
|
|
|
|
|
|
|
|
if (type >= LLCP_TLV_MAX)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
length = llcp_tlv_length[type];
|
|
|
|
|
if (length == 0 && value_length == 0)
|
|
|
|
|
return NULL;
|
2012-04-10 17:43:15 +00:00
|
|
|
else if (length == 0)
|
2011-12-14 15:43:12 +00:00
|
|
|
length = value_length;
|
|
|
|
|
|
|
|
|
|
*tlv_length = 2 + length;
|
|
|
|
|
tlv = kzalloc(2 + length, GFP_KERNEL);
|
|
|
|
|
if (tlv == NULL)
|
|
|
|
|
return tlv;
|
|
|
|
|
|
|
|
|
|
tlv[0] = type;
|
|
|
|
|
tlv[1] = length;
|
|
|
|
|
memcpy(tlv + 2, value, length);
|
|
|
|
|
|
|
|
|
|
return tlv;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_sdp_tlv *sdres;
|
|
|
|
|
u8 value[2];
|
|
|
|
|
|
|
|
|
|
sdres = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
|
|
|
|
|
if (sdres == NULL)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
value[0] = tid;
|
|
|
|
|
value[1] = sap;
|
|
|
|
|
|
|
|
|
|
sdres->tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, value, 2,
|
|
|
|
|
&sdres->tlv_len);
|
|
|
|
|
if (sdres->tlv == NULL) {
|
|
|
|
|
kfree(sdres);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sdres->tid = tid;
|
|
|
|
|
sdres->sap = sap;
|
|
|
|
|
|
|
|
|
|
INIT_HLIST_NODE(&sdres->node);
|
|
|
|
|
|
|
|
|
|
return sdres;
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri,
|
2013-02-15 09:43:06 +00:00
|
|
|
size_t uri_len)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_sdp_tlv *sdreq;
|
|
|
|
|
|
|
|
|
|
pr_debug("uri: %s, len: %zu\n", uri, uri_len);
|
|
|
|
|
|
2018-02-14 23:45:07 +00:00
|
|
|
/* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
|
|
|
|
|
if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
|
|
|
|
|
return NULL;
|
|
|
|
|
|
2013-02-15 09:43:06 +00:00
|
|
|
sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
|
|
|
|
|
if (sdreq == NULL)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
sdreq->tlv_len = uri_len + 3;
|
|
|
|
|
|
|
|
|
|
if (uri[uri_len - 1] == 0)
|
|
|
|
|
sdreq->tlv_len--;
|
|
|
|
|
|
|
|
|
|
sdreq->tlv = kzalloc(sdreq->tlv_len + 1, GFP_KERNEL);
|
|
|
|
|
if (sdreq->tlv == NULL) {
|
|
|
|
|
kfree(sdreq);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sdreq->tlv[0] = LLCP_TLV_SDREQ;
|
|
|
|
|
sdreq->tlv[1] = sdreq->tlv_len - 2;
|
|
|
|
|
sdreq->tlv[2] = tid;
|
|
|
|
|
|
|
|
|
|
sdreq->tid = tid;
|
|
|
|
|
sdreq->uri = sdreq->tlv + 3;
|
|
|
|
|
memcpy(sdreq->uri, uri, uri_len);
|
|
|
|
|
|
2013-03-04 14:43:32 +00:00
|
|
|
sdreq->time = jiffies;
|
|
|
|
|
|
2013-02-15 09:43:06 +00:00
|
|
|
INIT_HLIST_NODE(&sdreq->node);
|
|
|
|
|
|
|
|
|
|
return sdreq;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
|
|
|
|
|
{
|
|
|
|
|
kfree(sdp->tlv);
|
|
|
|
|
kfree(sdp);
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-15 09:43:06 +00:00
|
|
|
void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_sdp_tlv *sdp;
|
|
|
|
|
struct hlist_node *n;
|
|
|
|
|
|
|
|
|
|
hlist_for_each_entry_safe(sdp, n, head, node) {
|
|
|
|
|
hlist_del(&sdp->node);
|
|
|
|
|
|
|
|
|
|
nfc_llcp_free_sdp_tlv(sdp);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-05-07 20:03:34 +00:00
|
|
|
int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *tlv_array, u16 tlv_array_len)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *tlv = tlv_array;
|
|
|
|
|
u8 type, length, offset = 0;
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
pr_debug("TLV array length %d\n", tlv_array_len);
|
|
|
|
|
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
while (offset < tlv_array_len) {
|
|
|
|
|
type = tlv[0];
|
|
|
|
|
length = tlv[1];
|
|
|
|
|
|
|
|
|
|
pr_debug("type 0x%x length %d\n", type, length);
|
|
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
|
case LLCP_TLV_VERSION:
|
|
|
|
|
local->remote_version = llcp_tlv_version(tlv);
|
|
|
|
|
break;
|
|
|
|
|
case LLCP_TLV_MIUX:
|
|
|
|
|
local->remote_miu = llcp_tlv_miux(tlv) + 128;
|
|
|
|
|
break;
|
|
|
|
|
case LLCP_TLV_WKS:
|
|
|
|
|
local->remote_wks = llcp_tlv_wks(tlv);
|
|
|
|
|
break;
|
|
|
|
|
case LLCP_TLV_LTO:
|
|
|
|
|
local->remote_lto = llcp_tlv_lto(tlv) * 10;
|
|
|
|
|
break;
|
|
|
|
|
case LLCP_TLV_OPT:
|
|
|
|
|
local->remote_opt = llcp_tlv_opt(tlv);
|
|
|
|
|
break;
|
2012-05-07 20:03:34 +00:00
|
|
|
default:
|
|
|
|
|
pr_err("Invalid gt tlv value 0x%x\n", type);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
offset += length + 2;
|
|
|
|
|
tlv += length + 2;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x\n",
|
|
|
|
|
local->remote_version, local->remote_miu,
|
|
|
|
|
local->remote_lto, local->remote_opt,
|
|
|
|
|
local->remote_wks);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *tlv_array, u16 tlv_array_len)
|
2012-05-07 20:03:34 +00:00
|
|
|
{
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *tlv = tlv_array;
|
|
|
|
|
u8 type, length, offset = 0;
|
2012-05-07 20:03:34 +00:00
|
|
|
|
|
|
|
|
pr_debug("TLV array length %d\n", tlv_array_len);
|
|
|
|
|
|
|
|
|
|
if (sock == NULL)
|
|
|
|
|
return -ENOTCONN;
|
|
|
|
|
|
|
|
|
|
while (offset < tlv_array_len) {
|
|
|
|
|
type = tlv[0];
|
|
|
|
|
length = tlv[1];
|
|
|
|
|
|
|
|
|
|
pr_debug("type 0x%x length %d\n", type, length);
|
|
|
|
|
|
|
|
|
|
switch (type) {
|
2012-05-14 15:37:32 +00:00
|
|
|
case LLCP_TLV_MIUX:
|
2013-02-22 00:12:28 +00:00
|
|
|
sock->remote_miu = llcp_tlv_miux(tlv) + 128;
|
2012-05-14 15:37:32 +00:00
|
|
|
break;
|
2011-12-14 15:43:12 +00:00
|
|
|
case LLCP_TLV_RW:
|
2013-02-22 00:12:28 +00:00
|
|
|
sock->remote_rw = llcp_tlv_rw(tlv);
|
2011-12-14 15:43:12 +00:00
|
|
|
break;
|
2012-03-05 00:03:49 +00:00
|
|
|
case LLCP_TLV_SN:
|
|
|
|
|
break;
|
2011-12-14 15:43:12 +00:00
|
|
|
default:
|
|
|
|
|
pr_err("Invalid gt tlv value 0x%x\n", type);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
offset += length + 2;
|
|
|
|
|
tlv += length + 2;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-22 00:12:28 +00:00
|
|
|
pr_debug("sock %p rw %d miu %d\n", sock,
|
|
|
|
|
sock->remote_rw, sock->remote_miu);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *llcp_add_header(struct sk_buff *pdu,
|
2012-03-05 00:03:52 +00:00
|
|
|
u8 dsap, u8 ssap, u8 ptype)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
u8 header[2];
|
|
|
|
|
|
|
|
|
|
pr_debug("ptype 0x%x dsap 0x%x ssap 0x%x\n", ptype, dsap, ssap);
|
|
|
|
|
|
|
|
|
|
header[0] = (u8)((dsap << 2) | (ptype >> 2));
|
|
|
|
|
header[1] = (u8)((ptype << 6) | ssap);
|
|
|
|
|
|
|
|
|
|
pr_debug("header 0x%x 0x%x\n", header[0], header[1]);
|
|
|
|
|
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(pdu, header, LLCP_HEADER_SIZE);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
return pdu;
|
|
|
|
|
}
|
|
|
|
|
|
2021-07-30 14:41:59 +00:00
|
|
|
static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, const u8 *tlv,
|
2012-03-05 00:03:52 +00:00
|
|
|
u8 tlv_length)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
/* XXX Add an skb length check */
|
|
|
|
|
|
|
|
|
|
if (tlv == NULL)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(pdu, tlv, tlv_length);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
return pdu;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *llcp_allocate_pdu(struct nfc_llcp_sock *sock,
|
2012-03-05 00:03:52 +00:00
|
|
|
u8 cmd, u16 size)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
if (sock->ssap == 0)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
skb = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
|
2012-03-05 00:03:52 +00:00
|
|
|
size + LLCP_HEADER_SIZE, &err);
|
2011-12-14 15:43:12 +00:00
|
|
|
if (skb == NULL) {
|
|
|
|
|
pr_err("Could not allocate PDU\n");
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
skb = llcp_add_header(skb, sock->dsap, sock->ssap, cmd);
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2013-06-04 09:34:50 +00:00
|
|
|
int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock)
|
2011-12-14 15:43:12 +00:00
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
struct nfc_dev *dev;
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
|
|
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
dev = sock->dev;
|
|
|
|
|
if (dev == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
2012-10-04 23:09:07 +00:00
|
|
|
skb = llcp_allocate_pdu(sock, LLCP_PDU_DISC, 0);
|
2011-12-14 15:43:12 +00:00
|
|
|
if (skb == NULL)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
skb_queue_tail(&local->tx_queue, skb);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int nfc_llcp_send_symm(struct nfc_dev *dev)
|
|
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
u16 size = 0;
|
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
This commit fixes several use-after-free that caused by function
nfc_llcp_find_local(). For example, one UAF can happen when below buggy
time window occurs.
// nfc_genl_llc_get_params | // nfc_unregister_device
|
dev = nfc_get_device(idx); | device_lock(...)
if (!dev) | dev->shutting_down = true;
return -ENODEV; | device_unlock(...);
|
device_lock(...); | // nfc_llcp_unregister_device
| nfc_llcp_find_local()
nfc_llcp_find_local(...); |
| local_cleanup()
if (!local) { |
rc = -ENODEV; | // nfc_llcp_local_put
goto exit; | kref_put(.., local_release)
} |
| // local_release
| list_del(&local->list)
// nfc_genl_send_params | kfree()
local->dev->idx !!!UAF!!! |
|
and the crash trace for the one of the discussed UAF like:
BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
Read of size 8 at addr ffff888105b0e410 by task 20114
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:430
kasan_report+0xb2/0xe0 mm/kasan/report.c:536
nfc_genl_send_params net/nfc/netlink.c:999 [inline]
nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b6/0x200 net/socket.c:747
____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
__sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f34640a2389
RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
</TASK>
Allocated by task 20116:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
nfc_register_device+0x61/0x260 net/nfc/core.c:1124
nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
misc_open+0x379/0x4a0 drivers/char/misc.c:165
chrdev_open+0x26c/0x780 fs/char_dev.c:414
do_dentry_open+0x6c4/0x12a0 fs/open.c:920
do_open fs/namei.c:3560 [inline]
path_openat+0x24fe/0x37e0 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x171/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x200 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 20115:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x7a/0x190 mm/slub.c:3800
local_release net/nfc/llcp_core.c:174 [inline]
kref_put include/linux/kref.h:65 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
__fput+0x252/0xa20 fs/file_table.c:321
task_work_run+0x174/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Last potentially related work creation:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
call_netdevice_notifiers net/core/dev.c:1989 [inline]
dev_change_name+0x3c3/0x870 net/core/dev.c:1211
dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
sock_do_ioctl+0x160/0x260 net/socket.c:1213
sock_ioctl+0x3f9/0x670 net/socket.c:1316
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff888105b0e400
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
The buggy address belongs to the physical page:
head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
In summary, this patch solves those use-after-free by
1. Re-implement the nfc_llcp_find_local(). The current version does not
grab the reference when getting the local from the linked list. For
example, the llcp_sock_bind() gets the reference like below:
// llcp_sock_bind()
local = nfc_llcp_find_local(dev); // A
..... \
| raceable
..... /
llcp_sock->local = nfc_llcp_local_get(local); // B
There is an apparent race window that one can drop the reference
and free the local object fetched in (A) before (B) gets the reference.
2. Some callers of the nfc_llcp_find_local() do not grab the reference
at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
error handling function to put the reference.
3. Add the nfc_llcp_remove_local() helper. The local object is removed
from the linked list in local_release() when all reference is gone. This
patch removes it when nfc_llcp_unregister_device() is called.
Therefore, every caller of nfc_llcp_find_local() will get a reference
even when the nfc_llcp_unregister_device() is called. This promises no
use-after-free for the local object is ever possible.
Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-06-25 09:10:07 +00:00
|
|
|
int err;
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
local = nfc_llcp_find_local(dev);
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
size += LLCP_HEADER_SIZE;
|
|
|
|
|
size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
|
|
|
|
|
|
|
|
|
|
skb = alloc_skb(size, GFP_KERNEL);
|
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
This commit fixes several use-after-free that caused by function
nfc_llcp_find_local(). For example, one UAF can happen when below buggy
time window occurs.
// nfc_genl_llc_get_params | // nfc_unregister_device
|
dev = nfc_get_device(idx); | device_lock(...)
if (!dev) | dev->shutting_down = true;
return -ENODEV; | device_unlock(...);
|
device_lock(...); | // nfc_llcp_unregister_device
| nfc_llcp_find_local()
nfc_llcp_find_local(...); |
| local_cleanup()
if (!local) { |
rc = -ENODEV; | // nfc_llcp_local_put
goto exit; | kref_put(.., local_release)
} |
| // local_release
| list_del(&local->list)
// nfc_genl_send_params | kfree()
local->dev->idx !!!UAF!!! |
|
and the crash trace for the one of the discussed UAF like:
BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
Read of size 8 at addr ffff888105b0e410 by task 20114
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:430
kasan_report+0xb2/0xe0 mm/kasan/report.c:536
nfc_genl_send_params net/nfc/netlink.c:999 [inline]
nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b6/0x200 net/socket.c:747
____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
__sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f34640a2389
RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
</TASK>
Allocated by task 20116:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
nfc_register_device+0x61/0x260 net/nfc/core.c:1124
nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
misc_open+0x379/0x4a0 drivers/char/misc.c:165
chrdev_open+0x26c/0x780 fs/char_dev.c:414
do_dentry_open+0x6c4/0x12a0 fs/open.c:920
do_open fs/namei.c:3560 [inline]
path_openat+0x24fe/0x37e0 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x171/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x200 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 20115:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x7a/0x190 mm/slub.c:3800
local_release net/nfc/llcp_core.c:174 [inline]
kref_put include/linux/kref.h:65 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
__fput+0x252/0xa20 fs/file_table.c:321
task_work_run+0x174/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Last potentially related work creation:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
call_netdevice_notifiers net/core/dev.c:1989 [inline]
dev_change_name+0x3c3/0x870 net/core/dev.c:1211
dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
sock_do_ioctl+0x160/0x260 net/socket.c:1213
sock_ioctl+0x3f9/0x670 net/socket.c:1316
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff888105b0e400
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
The buggy address belongs to the physical page:
head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
In summary, this patch solves those use-after-free by
1. Re-implement the nfc_llcp_find_local(). The current version does not
grab the reference when getting the local from the linked list. For
example, the llcp_sock_bind() gets the reference like below:
// llcp_sock_bind()
local = nfc_llcp_find_local(dev); // A
..... \
| raceable
..... /
llcp_sock->local = nfc_llcp_local_get(local); // B
There is an apparent race window that one can drop the reference
and free the local object fetched in (A) before (B) gets the reference.
2. Some callers of the nfc_llcp_find_local() do not grab the reference
at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
error handling function to put the reference.
3. Add the nfc_llcp_remove_local() helper. The local object is removed
from the linked list in local_release() when all reference is gone. This
patch removes it when nfc_llcp_unregister_device() is called.
Therefore, every caller of nfc_llcp_find_local() will get a reference
even when the nfc_llcp_unregister_device() is called. This promises no
use-after-free for the local object is ever possible.
Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-06-25 09:10:07 +00:00
|
|
|
if (skb == NULL) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
|
|
|
|
|
|
|
|
|
|
skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);
|
|
|
|
|
|
2012-11-27 14:44:24 +00:00
|
|
|
__net_timestamp(skb);
|
|
|
|
|
|
2014-05-05 10:43:31 +00:00
|
|
|
nfc_llcp_send_to_raw_sock(local, skb, NFC_DIRECTION_TX);
|
2012-09-26 16:16:44 +00:00
|
|
|
|
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
This commit fixes several use-after-free that caused by function
nfc_llcp_find_local(). For example, one UAF can happen when below buggy
time window occurs.
// nfc_genl_llc_get_params | // nfc_unregister_device
|
dev = nfc_get_device(idx); | device_lock(...)
if (!dev) | dev->shutting_down = true;
return -ENODEV; | device_unlock(...);
|
device_lock(...); | // nfc_llcp_unregister_device
| nfc_llcp_find_local()
nfc_llcp_find_local(...); |
| local_cleanup()
if (!local) { |
rc = -ENODEV; | // nfc_llcp_local_put
goto exit; | kref_put(.., local_release)
} |
| // local_release
| list_del(&local->list)
// nfc_genl_send_params | kfree()
local->dev->idx !!!UAF!!! |
|
and the crash trace for the one of the discussed UAF like:
BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
Read of size 8 at addr ffff888105b0e410 by task 20114
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:430
kasan_report+0xb2/0xe0 mm/kasan/report.c:536
nfc_genl_send_params net/nfc/netlink.c:999 [inline]
nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b6/0x200 net/socket.c:747
____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
__sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f34640a2389
RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
</TASK>
Allocated by task 20116:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
nfc_register_device+0x61/0x260 net/nfc/core.c:1124
nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
misc_open+0x379/0x4a0 drivers/char/misc.c:165
chrdev_open+0x26c/0x780 fs/char_dev.c:414
do_dentry_open+0x6c4/0x12a0 fs/open.c:920
do_open fs/namei.c:3560 [inline]
path_openat+0x24fe/0x37e0 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x171/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x200 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 20115:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x7a/0x190 mm/slub.c:3800
local_release net/nfc/llcp_core.c:174 [inline]
kref_put include/linux/kref.h:65 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
__fput+0x252/0xa20 fs/file_table.c:321
task_work_run+0x174/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Last potentially related work creation:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
call_netdevice_notifiers net/core/dev.c:1989 [inline]
dev_change_name+0x3c3/0x870 net/core/dev.c:1211
dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
sock_do_ioctl+0x160/0x260 net/socket.c:1213
sock_ioctl+0x3f9/0x670 net/socket.c:1316
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff888105b0e400
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
The buggy address belongs to the physical page:
head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
In summary, this patch solves those use-after-free by
1. Re-implement the nfc_llcp_find_local(). The current version does not
grab the reference when getting the local from the linked list. For
example, the llcp_sock_bind() gets the reference like below:
// llcp_sock_bind()
local = nfc_llcp_find_local(dev); // A
..... \
| raceable
..... /
llcp_sock->local = nfc_llcp_local_get(local); // B
There is an apparent race window that one can drop the reference
and free the local object fetched in (A) before (B) gets the reference.
2. Some callers of the nfc_llcp_find_local() do not grab the reference
at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
error handling function to put the reference.
3. Add the nfc_llcp_remove_local() helper. The local object is removed
from the linked list in local_release() when all reference is gone. This
patch removes it when nfc_llcp_unregister_device() is called.
Therefore, every caller of nfc_llcp_find_local() will get a reference
even when the nfc_llcp_unregister_device() is called. This promises no
use-after-free for the local object is ever possible.
Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-06-25 09:10:07 +00:00
|
|
|
err = nfc_data_exchange(dev, local->target_idx, skb,
|
2012-03-05 00:03:52 +00:00
|
|
|
nfc_llcp_recv, local);
|
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
This commit fixes several use-after-free that caused by function
nfc_llcp_find_local(). For example, one UAF can happen when below buggy
time window occurs.
// nfc_genl_llc_get_params | // nfc_unregister_device
|
dev = nfc_get_device(idx); | device_lock(...)
if (!dev) | dev->shutting_down = true;
return -ENODEV; | device_unlock(...);
|
device_lock(...); | // nfc_llcp_unregister_device
| nfc_llcp_find_local()
nfc_llcp_find_local(...); |
| local_cleanup()
if (!local) { |
rc = -ENODEV; | // nfc_llcp_local_put
goto exit; | kref_put(.., local_release)
} |
| // local_release
| list_del(&local->list)
// nfc_genl_send_params | kfree()
local->dev->idx !!!UAF!!! |
|
and the crash trace for the one of the discussed UAF like:
BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
Read of size 8 at addr ffff888105b0e410 by task 20114
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:319 [inline]
print_report+0xcc/0x620 mm/kasan/report.c:430
kasan_report+0xb2/0xe0 mm/kasan/report.c:536
nfc_genl_send_params net/nfc/netlink.c:999 [inline]
nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045
genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968
genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065
netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x1b6/0x200 net/socket.c:747
____sys_sendmsg+0x6e9/0x890 net/socket.c:2501
___sys_sendmsg+0x110/0x1b0 net/socket.c:2555
__sys_sendmsg+0xf7/0x1d0 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f34640a2389
RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000
</TASK>
Allocated by task 20116:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383
kmalloc include/linux/slab.h:580 [inline]
kzalloc include/linux/slab.h:720 [inline]
nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567
nfc_register_device+0x61/0x260 net/nfc/core.c:1124
nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257
virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148
misc_open+0x379/0x4a0 drivers/char/misc.c:165
chrdev_open+0x26c/0x780 fs/char_dev.c:414
do_dentry_open+0x6c4/0x12a0 fs/open.c:920
do_open fs/namei.c:3560 [inline]
path_openat+0x24fe/0x37e0 fs/namei.c:3715
do_filp_open+0x1ba/0x410 fs/namei.c:3742
do_sys_openat2+0x171/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x200 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 20115:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free mm/kasan/common.c:200 [inline]
__kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:162 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
__kmem_cache_free+0x7a/0x190 mm/slub.c:3800
local_release net/nfc/llcp_core.c:174 [inline]
kref_put include/linux/kref.h:65 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline]
nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline]
nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620
nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179
virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163
__fput+0x252/0xa20 fs/file_table.c:321
task_work_run+0x174/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297
do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Last potentially related work creation:
kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491
kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328
drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735
unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773
unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753
neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895
addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684
notifier_call_chain+0xbe/0x210 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937
call_netdevice_notifiers_extack net/core/dev.c:1975 [inline]
call_netdevice_notifiers net/core/dev.c:1989 [inline]
dev_change_name+0x3c3/0x870 net/core/dev.c:1211
dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376
dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542
sock_do_ioctl+0x160/0x260 net/socket.c:1213
sock_ioctl+0x3f9/0x670 net/socket.c:1316
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The buggy address belongs to the object at ffff888105b0e400
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff888105b0e400, ffff888105b0e800)
The buggy address belongs to the physical page:
head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
In summary, this patch solves those use-after-free by
1. Re-implement the nfc_llcp_find_local(). The current version does not
grab the reference when getting the local from the linked list. For
example, the llcp_sock_bind() gets the reference like below:
// llcp_sock_bind()
local = nfc_llcp_find_local(dev); // A
..... \
| raceable
..... /
llcp_sock->local = nfc_llcp_local_get(local); // B
There is an apparent race window that one can drop the reference
and free the local object fetched in (A) before (B) gets the reference.
2. Some callers of the nfc_llcp_find_local() do not grab the reference
at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions.
We add the nfc_llcp_local_put() for them. Moreover, we add the necessary
error handling function to put the reference.
3. Add the nfc_llcp_remove_local() helper. The local object is removed
from the linked list in local_release() when all reference is gone. This
patch removes it when nfc_llcp_unregister_device() is called.
Therefore, every caller of nfc_llcp_find_local() will get a reference
even when the nfc_llcp_unregister_device() is called. This promises no
use-after-free for the local object is ever possible.
Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support")
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-06-25 09:10:07 +00:00
|
|
|
out:
|
|
|
|
|
nfc_llcp_local_put(local);
|
|
|
|
|
return err;
|
2011-12-14 15:43:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
struct sk_buff *skb;
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *service_name_tlv = NULL;
|
|
|
|
|
const u8 *miux_tlv = NULL;
|
|
|
|
|
const u8 *rw_tlv = NULL;
|
2023-05-13 11:52:04 +00:00
|
|
|
u8 service_name_tlv_length = 0;
|
|
|
|
|
u8 miux_tlv_length, rw_tlv_length, rw;
|
2011-12-14 15:43:12 +00:00
|
|
|
int err;
|
2014-12-02 20:27:57 +00:00
|
|
|
u16 size = 0;
|
|
|
|
|
__be16 miux;
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
if (sock->service_name != NULL) {
|
|
|
|
|
service_name_tlv = nfc_llcp_build_tlv(LLCP_TLV_SN,
|
2012-03-05 00:03:52 +00:00
|
|
|
sock->service_name,
|
|
|
|
|
sock->service_name_len,
|
|
|
|
|
&service_name_tlv_length);
|
2019-02-22 07:37:58 +00:00
|
|
|
if (!service_name_tlv) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
2011-12-14 15:43:12 +00:00
|
|
|
size += service_name_tlv_length;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-22 10:38:05 +00:00
|
|
|
/* If the socket parameters are not set, use the local ones */
|
2013-03-20 15:06:12 +00:00
|
|
|
miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
|
|
|
|
|
local->miux : sock->miux;
|
2013-02-22 10:38:05 +00:00
|
|
|
rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
|
|
|
|
|
|
|
|
|
|
miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
|
2012-03-05 00:03:52 +00:00
|
|
|
&miux_tlv_length);
|
2019-02-22 07:37:58 +00:00
|
|
|
if (!miux_tlv) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
2012-03-05 00:03:43 +00:00
|
|
|
size += miux_tlv_length;
|
|
|
|
|
|
2013-02-22 10:38:05 +00:00
|
|
|
rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
|
2019-02-22 07:37:58 +00:00
|
|
|
if (!rw_tlv) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
2012-03-05 00:03:43 +00:00
|
|
|
size += rw_tlv_length;
|
|
|
|
|
|
2011-12-14 15:43:12 +00:00
|
|
|
pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
|
|
|
|
|
|
|
|
|
|
skb = llcp_allocate_pdu(sock, LLCP_PDU_CONNECT, size);
|
|
|
|
|
if (skb == NULL) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-29 08:48:22 +00:00
|
|
|
llcp_add_tlv(skb, service_name_tlv, service_name_tlv_length);
|
|
|
|
|
llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
|
|
|
|
|
llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
|
2012-03-05 00:03:43 +00:00
|
|
|
|
2011-12-14 15:43:12 +00:00
|
|
|
skb_queue_tail(&local->tx_queue, skb);
|
|
|
|
|
|
2016-06-29 08:48:23 +00:00
|
|
|
err = 0;
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
error_tlv:
|
2016-06-29 08:48:23 +00:00
|
|
|
if (err)
|
|
|
|
|
pr_err("error %d\n", err);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
kfree(service_name_tlv);
|
2012-03-05 00:03:43 +00:00
|
|
|
kfree(miux_tlv);
|
|
|
|
|
kfree(rw_tlv);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
struct sk_buff *skb;
|
2021-07-30 14:41:59 +00:00
|
|
|
const u8 *miux_tlv = NULL;
|
|
|
|
|
const u8 *rw_tlv = NULL;
|
|
|
|
|
u8 miux_tlv_length, rw_tlv_length, rw;
|
2012-03-05 00:03:43 +00:00
|
|
|
int err;
|
2014-12-02 20:27:57 +00:00
|
|
|
u16 size = 0;
|
|
|
|
|
__be16 miux;
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
2013-02-22 10:38:05 +00:00
|
|
|
/* If the socket parameters are not set, use the local ones */
|
2013-03-20 15:06:12 +00:00
|
|
|
miux = be16_to_cpu(sock->miux) > LLCP_MAX_MIUX ?
|
|
|
|
|
local->miux : sock->miux;
|
2013-02-22 10:38:05 +00:00
|
|
|
rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
|
|
|
|
|
|
|
|
|
|
miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
|
2012-03-05 00:03:52 +00:00
|
|
|
&miux_tlv_length);
|
2019-02-22 07:37:58 +00:00
|
|
|
if (!miux_tlv) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
2012-03-05 00:03:43 +00:00
|
|
|
size += miux_tlv_length;
|
|
|
|
|
|
2013-02-22 10:38:05 +00:00
|
|
|
rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
|
2019-02-22 07:37:58 +00:00
|
|
|
if (!rw_tlv) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
2012-03-05 00:03:43 +00:00
|
|
|
size += rw_tlv_length;
|
|
|
|
|
|
|
|
|
|
skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
|
|
|
|
|
if (skb == NULL) {
|
|
|
|
|
err = -ENOMEM;
|
|
|
|
|
goto error_tlv;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-29 08:48:22 +00:00
|
|
|
llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
|
|
|
|
|
llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
skb_queue_tail(&local->tx_queue, skb);
|
|
|
|
|
|
2016-06-29 08:48:23 +00:00
|
|
|
err = 0;
|
2012-03-05 00:03:43 +00:00
|
|
|
|
|
|
|
|
error_tlv:
|
2016-06-29 08:48:23 +00:00
|
|
|
if (err)
|
|
|
|
|
pr_err("error %d\n", err);
|
2012-03-05 00:03:43 +00:00
|
|
|
|
|
|
|
|
kfree(miux_tlv);
|
|
|
|
|
kfree(rw_tlv);
|
|
|
|
|
|
|
|
|
|
return err;
|
2011-12-14 15:43:12 +00:00
|
|
|
}
|
|
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
|
|
|
|
|
size_t tlv_length)
|
2012-10-04 23:13:24 +00:00
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
struct nfc_dev *dev;
|
|
|
|
|
u16 size = 0;
|
|
|
|
|
|
|
|
|
|
if (local == NULL)
|
2013-02-15 09:43:05 +00:00
|
|
|
return ERR_PTR(-ENODEV);
|
2012-10-04 23:13:24 +00:00
|
|
|
|
|
|
|
|
dev = local->dev;
|
|
|
|
|
if (dev == NULL)
|
2013-02-15 09:43:05 +00:00
|
|
|
return ERR_PTR(-ENODEV);
|
2012-10-04 23:13:24 +00:00
|
|
|
|
|
|
|
|
size += LLCP_HEADER_SIZE;
|
|
|
|
|
size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
|
2013-02-15 09:43:05 +00:00
|
|
|
size += tlv_length;
|
2012-10-04 23:13:24 +00:00
|
|
|
|
|
|
|
|
skb = alloc_skb(size, GFP_KERNEL);
|
2013-02-15 09:43:05 +00:00
|
|
|
if (skb == NULL)
|
|
|
|
|
return ERR_PTR(-ENOMEM);
|
2012-10-04 23:13:24 +00:00
|
|
|
|
|
|
|
|
skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
|
|
|
|
|
|
|
|
|
|
skb = llcp_add_header(skb, LLCP_SAP_SDP, LLCP_SAP_SDP, LLCP_PDU_SNL);
|
|
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
return skb;
|
|
|
|
|
}
|
2012-10-04 23:13:24 +00:00
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
|
|
|
|
|
struct hlist_head *tlv_list, size_t tlvs_len)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_sdp_tlv *sdp;
|
|
|
|
|
struct hlist_node *n;
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
|
|
|
|
|
skb = nfc_llcp_allocate_snl(local, tlvs_len);
|
|
|
|
|
if (IS_ERR(skb))
|
|
|
|
|
return PTR_ERR(skb);
|
|
|
|
|
|
|
|
|
|
hlist_for_each_entry_safe(sdp, n, tlv_list, node) {
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(skb, sdp->tlv, sdp->tlv_len);
|
2012-10-04 23:13:24 +00:00
|
|
|
|
2013-02-15 09:43:05 +00:00
|
|
|
hlist_del(&sdp->node);
|
|
|
|
|
|
|
|
|
|
nfc_llcp_free_sdp_tlv(sdp);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
skb_queue_tail(&local->tx_queue, skb);
|
2012-10-04 23:13:24 +00:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-15 09:43:06 +00:00
|
|
|
int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
|
|
|
|
|
struct hlist_head *tlv_list, size_t tlvs_len)
|
|
|
|
|
{
|
|
|
|
|
struct nfc_llcp_sdp_tlv *sdreq;
|
|
|
|
|
struct hlist_node *n;
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
|
|
|
|
|
skb = nfc_llcp_allocate_snl(local, tlvs_len);
|
|
|
|
|
if (IS_ERR(skb))
|
|
|
|
|
return PTR_ERR(skb);
|
|
|
|
|
|
|
|
|
|
mutex_lock(&local->sdreq_lock);
|
|
|
|
|
|
2013-03-04 14:43:32 +00:00
|
|
|
if (hlist_empty(&local->pending_sdreqs))
|
|
|
|
|
mod_timer(&local->sdreq_timer,
|
|
|
|
|
jiffies + msecs_to_jiffies(3 * local->remote_lto));
|
|
|
|
|
|
2013-02-15 09:43:06 +00:00
|
|
|
hlist_for_each_entry_safe(sdreq, n, tlv_list, node) {
|
|
|
|
|
pr_debug("tid %d for %s\n", sdreq->tid, sdreq->uri);
|
|
|
|
|
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(skb, sdreq->tlv, sdreq->tlv_len);
|
2013-02-15 09:43:06 +00:00
|
|
|
|
|
|
|
|
hlist_del(&sdreq->node);
|
|
|
|
|
|
|
|
|
|
hlist_add_head(&sdreq->node, &local->pending_sdreqs);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
mutex_unlock(&local->sdreq_lock);
|
|
|
|
|
|
|
|
|
|
skb_queue_tail(&local->tx_queue, skb);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2011-12-14 15:43:12 +00:00
|
|
|
int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason)
|
|
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
struct nfc_dev *dev;
|
|
|
|
|
u16 size = 1; /* Reason code */
|
|
|
|
|
|
|
|
|
|
pr_debug("Sending DM reason 0x%x\n", reason);
|
|
|
|
|
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
dev = local->dev;
|
|
|
|
|
if (dev == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
size += LLCP_HEADER_SIZE;
|
|
|
|
|
size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
|
|
|
|
|
|
|
|
|
|
skb = alloc_skb(size, GFP_KERNEL);
|
|
|
|
|
if (skb == NULL)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
|
|
|
|
|
|
2012-04-10 17:43:16 +00:00
|
|
|
skb = llcp_add_header(skb, dsap, ssap, LLCP_PDU_DM);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(skb, &reason, 1);
|
2011-12-14 15:43:12 +00:00
|
|
|
|
|
|
|
|
skb_queue_head(&local->tx_queue, skb);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-05 00:03:37 +00:00
|
|
|
int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
|
2012-03-05 00:03:52 +00:00
|
|
|
struct msghdr *msg, size_t len)
|
2012-03-05 00:03:37 +00:00
|
|
|
{
|
|
|
|
|
struct sk_buff *pdu;
|
2012-03-05 00:03:44 +00:00
|
|
|
struct sock *sk = &sock->sk;
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
size_t frag_len = 0, remaining_len;
|
|
|
|
|
u8 *msg_data, *msg_ptr;
|
2013-04-02 08:25:14 +00:00
|
|
|
u16 remote_miu;
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
pr_debug("Send I frame len %zd\n", len);
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-11-01 22:33:00 +00:00
|
|
|
/* Remote is ready but has not acknowledged our frames */
|
|
|
|
|
if((sock->remote_ready &&
|
2013-02-22 00:12:28 +00:00
|
|
|
skb_queue_len(&sock->tx_pending_queue) >= sock->remote_rw &&
|
|
|
|
|
skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
|
2012-11-01 22:33:00 +00:00
|
|
|
pr_err("Pending queue is full %d frames\n",
|
|
|
|
|
skb_queue_len(&sock->tx_pending_queue));
|
|
|
|
|
return -ENOBUFS;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Remote is not ready and we've been queueing enough frames */
|
|
|
|
|
if ((!sock->remote_ready &&
|
2013-02-22 00:12:28 +00:00
|
|
|
skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
|
2012-11-01 22:33:00 +00:00
|
|
|
pr_err("Tx queue is full %d frames\n",
|
|
|
|
|
skb_queue_len(&sock->tx_queue));
|
|
|
|
|
return -ENOBUFS;
|
|
|
|
|
}
|
|
|
|
|
|
2016-01-29 19:24:24 +00:00
|
|
|
msg_data = kmalloc(len, GFP_USER | __GFP_NOWARN);
|
2012-03-05 00:03:44 +00:00
|
|
|
if (msg_data == NULL)
|
|
|
|
|
return -ENOMEM;
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2014-04-07 01:25:44 +00:00
|
|
|
if (memcpy_from_msg(msg_data, msg, len)) {
|
2012-03-05 00:03:52 +00:00
|
|
|
kfree(msg_data);
|
|
|
|
|
return -EFAULT;
|
2012-03-05 00:03:37 +00:00
|
|
|
}
|
|
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
remaining_len = len;
|
|
|
|
|
msg_ptr = msg_data;
|
|
|
|
|
|
2013-03-25 10:24:21 +00:00
|
|
|
do {
|
2013-04-02 08:25:14 +00:00
|
|
|
remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
|
2013-11-30 15:59:23 +00:00
|
|
|
LLCP_DEFAULT_MIU : sock->remote_miu;
|
2013-04-02 08:25:14 +00:00
|
|
|
|
|
|
|
|
frag_len = min_t(size_t, remote_miu, remaining_len);
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
pr_debug("Fragment %zd bytes remaining %zd",
|
|
|
|
|
frag_len, remaining_len);
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
pdu = llcp_allocate_pdu(sock, LLCP_PDU_I,
|
|
|
|
|
frag_len + LLCP_SEQUENCE_SIZE);
|
2013-11-30 15:14:57 +00:00
|
|
|
if (pdu == NULL) {
|
|
|
|
|
kfree(msg_data);
|
2012-03-05 00:03:44 +00:00
|
|
|
return -ENOMEM;
|
2013-11-30 15:14:57 +00:00
|
|
|
}
|
2012-03-05 00:03:44 +00:00
|
|
|
|
|
|
|
|
skb_put(pdu, LLCP_SEQUENCE_SIZE);
|
|
|
|
|
|
2013-03-25 10:24:21 +00:00
|
|
|
if (likely(frag_len > 0))
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(pdu, msg_ptr, frag_len);
|
2012-03-05 00:03:44 +00:00
|
|
|
|
2012-05-10 17:45:52 +00:00
|
|
|
skb_queue_tail(&sock->tx_queue, pdu);
|
2012-03-05 00:03:44 +00:00
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
nfc_llcp_queue_i_frames(sock);
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
|
|
|
|
|
remaining_len -= frag_len;
|
2012-04-10 17:43:03 +00:00
|
|
|
msg_ptr += frag_len;
|
2013-03-25 10:24:21 +00:00
|
|
|
} while (remaining_len > 0);
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-03-05 00:03:44 +00:00
|
|
|
kfree(msg_data);
|
2012-03-05 00:03:37 +00:00
|
|
|
|
2012-05-07 10:31:21 +00:00
|
|
|
return len;
|
2012-03-05 00:03:37 +00:00
|
|
|
}
|
2012-03-05 00:03:42 +00:00
|
|
|
|
2012-10-16 13:01:40 +00:00
|
|
|
int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
|
|
|
|
|
struct msghdr *msg, size_t len)
|
|
|
|
|
{
|
|
|
|
|
struct sk_buff *pdu;
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
size_t frag_len = 0, remaining_len;
|
2012-10-29 13:02:17 +00:00
|
|
|
u8 *msg_ptr, *msg_data;
|
2013-04-02 08:25:14 +00:00
|
|
|
u16 remote_miu;
|
2012-10-16 13:01:40 +00:00
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
pr_debug("Send UI frame len %zd\n", len);
|
|
|
|
|
|
|
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
2016-01-29 19:24:24 +00:00
|
|
|
msg_data = kmalloc(len, GFP_USER | __GFP_NOWARN);
|
2012-10-29 13:02:17 +00:00
|
|
|
if (msg_data == NULL)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
2014-04-07 01:25:44 +00:00
|
|
|
if (memcpy_from_msg(msg_data, msg, len)) {
|
2012-10-29 13:02:17 +00:00
|
|
|
kfree(msg_data);
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
}
|
|
|
|
|
|
2012-10-16 13:01:40 +00:00
|
|
|
remaining_len = len;
|
2012-10-29 13:02:17 +00:00
|
|
|
msg_ptr = msg_data;
|
2012-10-16 13:01:40 +00:00
|
|
|
|
2013-03-25 10:24:21 +00:00
|
|
|
do {
|
2013-04-02 08:25:14 +00:00
|
|
|
remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
|
|
|
|
|
local->remote_miu : sock->remote_miu;
|
|
|
|
|
|
|
|
|
|
frag_len = min_t(size_t, remote_miu, remaining_len);
|
2012-10-16 13:01:40 +00:00
|
|
|
|
|
|
|
|
pr_debug("Fragment %zd bytes remaining %zd",
|
|
|
|
|
frag_len, remaining_len);
|
|
|
|
|
|
2018-07-18 09:57:27 +00:00
|
|
|
pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
|
2012-10-16 13:01:40 +00:00
|
|
|
frag_len + LLCP_HEADER_SIZE, &err);
|
|
|
|
|
if (pdu == NULL) {
|
2018-07-18 09:57:27 +00:00
|
|
|
pr_err("Could not allocate PDU (error=%d)\n", err);
|
|
|
|
|
len -= remaining_len;
|
|
|
|
|
if (len == 0)
|
|
|
|
|
len = err;
|
|
|
|
|
break;
|
2012-10-16 13:01:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);
|
|
|
|
|
|
2013-03-25 10:24:21 +00:00
|
|
|
if (likely(frag_len > 0))
|
networking: introduce and use skb_put_data()
A common pattern with skb_put() is to just want to memcpy()
some data into the new space, introduce skb_put_data() for
this.
An spatch similar to the one for skb_put_zero() converts many
of the places using it:
@@
identifier p, p2;
expression len, skb, data;
type t, t2;
@@
(
-p = skb_put(skb, len);
+p = skb_put_data(skb, data, len);
|
-p = (t)skb_put(skb, len);
+p = skb_put_data(skb, data, len);
)
(
p2 = (t2)p;
-memcpy(p2, data, len);
|
-memcpy(p, data, len);
)
@@
type t, t2;
identifier p, p2;
expression skb, data;
@@
t *p;
...
(
-p = skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
|
-p = (t *)skb_put(skb, sizeof(t));
+p = skb_put_data(skb, data, sizeof(t));
)
(
p2 = (t2)p;
-memcpy(p2, data, sizeof(*p));
|
-memcpy(p, data, sizeof(*p));
)
@@
expression skb, len, data;
@@
-memcpy(skb_put(skb, len), data, len);
+skb_put_data(skb, data, len);
(again, manually post-processed to retain some comments)
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 12:29:20 +00:00
|
|
|
skb_put_data(pdu, msg_ptr, frag_len);
|
2012-10-16 13:01:40 +00:00
|
|
|
|
|
|
|
|
/* No need to check for the peer RW for UI frames */
|
|
|
|
|
skb_queue_tail(&local->tx_queue, pdu);
|
|
|
|
|
|
|
|
|
|
remaining_len -= frag_len;
|
|
|
|
|
msg_ptr += frag_len;
|
2013-03-25 10:24:21 +00:00
|
|
|
} while (remaining_len > 0);
|
2012-10-16 13:01:40 +00:00
|
|
|
|
2012-10-29 13:02:17 +00:00
|
|
|
kfree(msg_data);
|
|
|
|
|
|
2012-10-16 13:01:40 +00:00
|
|
|
return len;
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-05 00:03:42 +00:00
|
|
|
int nfc_llcp_send_rr(struct nfc_llcp_sock *sock)
|
|
|
|
|
{
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
struct nfc_llcp_local *local;
|
|
|
|
|
|
|
|
|
|
pr_debug("Send rr nr %d\n", sock->recv_n);
|
|
|
|
|
|
|
|
|
|
local = sock->local;
|
|
|
|
|
if (local == NULL)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
|
|
|
|
skb = llcp_allocate_pdu(sock, LLCP_PDU_RR, LLCP_SEQUENCE_SIZE);
|
|
|
|
|
if (skb == NULL)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
skb_put(skb, LLCP_SEQUENCE_SIZE);
|
|
|
|
|
|
2012-04-10 17:43:14 +00:00
|
|
|
skb->data[2] = sock->recv_n;
|
2012-03-05 00:03:42 +00:00
|
|
|
|
|
|
|
|
skb_queue_head(&local->tx_queue, skb);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
