[PATCH 0/2] NFC fixes for 3.5

[PATCH 0/2] NFC fixes for 3.5

[Samuel Ortiz]

Hi John,

I have a couple of 3.5 fixes for NFC, one of them being a security issue.
As usual you can apply them manually or pull from:

git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0.git for-wireless

Dan Rosenberg (1):
  NFC: Prevent multiple buffer overflows in NCI

Eric Dumazet (1):
  NFC: Return from rawsock_release when sk is NULL

 net/nfc/nci/ntf.c |   10 +++++-----
 net/nfc/rawsock.c |    5 ++++-
 2 files changed, 9 insertions(+), 6 deletions(-)

-- 
1.7.10

[PATCH 0/2] NFC fixes for 3.5

[Samuel Ortiz]

Hi John,

I have a couple of HCI fixes from Mathias, for 3.5. Thanks in advance for
pulling them in.

You can pull them from:

git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0.git tags/nfc-fixes-3.5-2


Mathias Jeppsson (2):
  NFC: Fix empty HCI message list check
  NFC: Fix order of arguments to list_add_tail() when queueing HCP
    frames

 net/nfc/hci/core.c |    5 ++---
 net/nfc/hci/hcp.c  |    2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

-- 
1.7.10

[PATCH 1/2] NFC: Fix empty HCI message list check

[Samuel Ortiz]

From: Mathias Jeppsson <mathias.jeppsson@sonymobile.com>

list_first_entry() will never return NULL. Instead use
list_for_each_entry_safe() to iterate through the list.

Signed-off-by: Mathias Jeppsson <mathias.jeppsson@sonymobile.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
---
 net/nfc/hci/core.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index e1a640d..da6e039 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -682,13 +682,12 @@ EXPORT_SYMBOL(nfc_hci_register_device);
 
 void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
 {
-	struct hci_msg *msg;
+	struct hci_msg *msg, *n;
 
 	skb_queue_purge(&hdev->rx_hcp_frags);
 	skb_queue_purge(&hdev->msg_rx_queue);
 
-	while ((msg = list_first_entry(&hdev->msg_tx_queue, struct hci_msg,
-				       msg_l)) != NULL) {
+	list_for_each_entry_safe(msg, n, &hdev->msg_tx_queue, msg_l) {
 		list_del(&msg->msg_l);
 		skb_queue_purge(&msg->msg_frags);
 		kfree(msg);
-- 
1.7.10

[PATCH 2/2] NFC: Fix order of arguments to list_add_tail() when queueing HCP frames

[Samuel Ortiz]

From: Mathias Jeppsson <mathias.jeppsson@sonymobile.com>

The HCP message should be added to transmit queue, not the other way around.

Signed-off-by: Mathias Jeppsson <mathias.jeppsson@sonymobile.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
---
 net/nfc/hci/hcp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/hci/hcp.c b/net/nfc/hci/hcp.c
index 7212cf2..f4dad1a 100644
--- a/net/nfc/hci/hcp.c
+++ b/net/nfc/hci/hcp.c
@@ -105,7 +105,7 @@ int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe,
 	}
 
 	mutex_lock(&hdev->msg_tx_mutex);
-	list_add_tail(&hdev->msg_tx_queue, &cmd->msg_l);
+	list_add_tail(&cmd->msg_l, &hdev->msg_tx_queue);
 	mutex_unlock(&hdev->msg_tx_mutex);
 
 	queue_work(hdev->msg_tx_wq, &hdev->msg_tx_work);
-- 
1.7.10

[PATCH 0/2] NFC fixes for 3.5

[Samuel Ortiz]

Hi John,

The 3rd and hopefully last pull request for NFC fixes.
You can pull them from:

git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0.git tags/nfc-fixes-3.5-3

Dave Jones (1):
  NFC: NCI module license 'unspecified' taints kernel

Eric Lapuyade (1):
  NFC: Set target nfcid1 for all HCI reader A targets

 net/nfc/hci/core.c |   15 +++++++++++++++
 net/nfc/nci/core.c |    3 +++
 2 files changed, 18 insertions(+)

-- 
1.7.10