hc
2024-01-05 071106ecf68c401173c58808b1cf5f68cc50d390
kernel/net/nfc/llcp_core.c
....@@ -17,6 +17,8 @@
1717 static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
1818
1919 static LIST_HEAD(llcp_devices);
20
+/* Protects llcp_devices list */
21
+static DEFINE_SPINLOCK(llcp_devices_lock);
2022
2123 static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb);
2224
....@@ -143,7 +145,7 @@
143145 write_unlock(&local->raw_sockets.lock);
144146 }
145147
146
-struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
148
+static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
147149 {
148150 kref_get(&local->ref);
149151
....@@ -159,6 +161,7 @@
159161 cancel_work_sync(&local->rx_work);
160162 cancel_work_sync(&local->timeout_work);
161163 kfree_skb(local->rx_pending);
164
+ local->rx_pending = NULL;
162165 del_timer_sync(&local->sdreq_timer);
163166 cancel_work_sync(&local->sdreq_timeout_work);
164167 nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs);
....@@ -170,7 +173,6 @@
170173
171174 local = container_of(ref, struct nfc_llcp_local, ref);
172175
173
- list_del(&local->list);
174176 local_cleanup(local);
175177 kfree(local);
176178 }
....@@ -283,12 +285,33 @@
283285 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
284286 {
285287 struct nfc_llcp_local *local;
288
+ struct nfc_llcp_local *res = NULL;
286289
290
+ spin_lock(&llcp_devices_lock);
287291 list_for_each_entry(local, &llcp_devices, list)
288
- if (local->dev == dev)
289
- return local;
292
+ if (local->dev == dev) {
293
+ res = nfc_llcp_local_get(local);
294
+ break;
295
+ }
296
+ spin_unlock(&llcp_devices_lock);
290297
291
- pr_debug("No device found\n");
298
+ return res;
299
+}
300
+
301
+static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)
302
+{
303
+ struct nfc_llcp_local *local, *tmp;
304
+
305
+ spin_lock(&llcp_devices_lock);
306
+ list_for_each_entry_safe(local, tmp, &llcp_devices, list)
307
+ if (local->dev == dev) {
308
+ list_del(&local->list);
309
+ spin_unlock(&llcp_devices_lock);
310
+ return local;
311
+ }
312
+ spin_unlock(&llcp_devices_lock);
313
+
314
+ pr_warn("Shutting down device not found\n");
292315
293316 return NULL;
294317 }
....@@ -301,7 +324,7 @@
301324 "urn:nfc:sn:snep",
302325 };
303326
304
-static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
327
+static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
305328 {
306329 int sap, num_wks;
307330
....@@ -325,7 +348,7 @@
325348
326349 static
327350 struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
328
- u8 *sn, size_t sn_len)
351
+ const u8 *sn, size_t sn_len)
329352 {
330353 struct sock *sk;
331354 struct nfc_llcp_sock *llcp_sock, *tmp_sock;
....@@ -522,7 +545,7 @@
522545 {
523546 u8 *gb_cur, version, version_length;
524547 u8 lto_length, wks_length, miux_length;
525
- u8 *version_tlv = NULL, *lto_tlv = NULL,
548
+ const u8 *version_tlv = NULL, *lto_tlv = NULL,
526549 *wks_tlv = NULL, *miux_tlv = NULL;
527550 __be16 wks = cpu_to_be16(local->local_wks);
528551 u8 gb_len = 0;
....@@ -609,12 +632,15 @@
609632
610633 *general_bytes_len = local->gb_len;
611634
635
+ nfc_llcp_local_put(local);
636
+
612637 return local->gb;
613638 }
614639
615
-int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
640
+int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
616641 {
617642 struct nfc_llcp_local *local;
643
+ int err;
618644
619645 if (gb_len < 3 || gb_len > NFC_MAX_GT_LEN)
620646 return -EINVAL;
....@@ -631,35 +657,39 @@
631657
632658 if (memcmp(local->remote_gb, llcp_magic, 3)) {
633659 pr_err("MAC does not support LLCP\n");
634
- return -EINVAL;
660
+ err = -EINVAL;
661
+ goto out;
635662 }
636663
637
- return nfc_llcp_parse_gb_tlv(local,
664
+ err = nfc_llcp_parse_gb_tlv(local,
638665 &local->remote_gb[3],
639666 local->remote_gb_len - 3);
667
+out:
668
+ nfc_llcp_local_put(local);
669
+ return err;
640670 }
641671
642
-static u8 nfc_llcp_dsap(struct sk_buff *pdu)
672
+static u8 nfc_llcp_dsap(const struct sk_buff *pdu)
643673 {
644674 return (pdu->data[0] & 0xfc) >> 2;
645675 }
646676
647
-static u8 nfc_llcp_ptype(struct sk_buff *pdu)
677
+static u8 nfc_llcp_ptype(const struct sk_buff *pdu)
648678 {
649679 return ((pdu->data[0] & 0x03) << 2) | ((pdu->data[1] & 0xc0) >> 6);
650680 }
651681
652
-static u8 nfc_llcp_ssap(struct sk_buff *pdu)
682
+static u8 nfc_llcp_ssap(const struct sk_buff *pdu)
653683 {
654684 return pdu->data[1] & 0x3f;
655685 }
656686
657
-static u8 nfc_llcp_ns(struct sk_buff *pdu)
687
+static u8 nfc_llcp_ns(const struct sk_buff *pdu)
658688 {
659689 return pdu->data[2] >> 4;
660690 }
661691
662
-static u8 nfc_llcp_nr(struct sk_buff *pdu)
692
+static u8 nfc_llcp_nr(const struct sk_buff *pdu)
663693 {
664694 return pdu->data[2] & 0xf;
665695 }
....@@ -801,7 +831,7 @@
801831 }
802832
803833 static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
804
- u8 *sn, size_t sn_len)
834
+ const u8 *sn, size_t sn_len)
805835 {
806836 struct nfc_llcp_sock *llcp_sock;
807837
....@@ -815,9 +845,10 @@
815845 return llcp_sock;
816846 }
817847
818
-static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len)
848
+static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
819849 {
820
- u8 *tlv = &skb->data[2], type, length;
850
+ u8 type, length;
851
+ const u8 *tlv = &skb->data[2];
821852 size_t tlv_array_len = skb->len - LLCP_HEADER_SIZE, offset = 0;
822853
823854 while (offset < tlv_array_len) {
....@@ -875,7 +906,7 @@
875906 }
876907
877908 static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
878
- struct sk_buff *skb)
909
+ const struct sk_buff *skb)
879910 {
880911 struct sock *new_sk, *parent;
881912 struct nfc_llcp_sock *sock, *new_sock;
....@@ -893,7 +924,7 @@
893924 goto fail;
894925 }
895926 } else {
896
- u8 *sn;
927
+ const u8 *sn;
897928 size_t sn_len;
898929
899930 sn = nfc_llcp_connect_sn(skb, &sn_len);
....@@ -1112,7 +1143,7 @@
11121143 }
11131144
11141145 static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
1115
- struct sk_buff *skb)
1146
+ const struct sk_buff *skb)
11161147 {
11171148 struct nfc_llcp_sock *llcp_sock;
11181149 struct sock *sk;
....@@ -1155,7 +1186,8 @@
11551186 nfc_llcp_sock_put(llcp_sock);
11561187 }
11571188
1158
-static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
1189
+static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
1190
+ const struct sk_buff *skb)
11591191 {
11601192 struct nfc_llcp_sock *llcp_sock;
11611193 struct sock *sk;
....@@ -1188,7 +1220,8 @@
11881220 nfc_llcp_sock_put(llcp_sock);
11891221 }
11901222
1191
-static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb)
1223
+static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
1224
+ const struct sk_buff *skb)
11921225 {
11931226 struct nfc_llcp_sock *llcp_sock;
11941227 struct sock *sk;
....@@ -1226,12 +1259,13 @@
12261259 }
12271260
12281261 static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
1229
- struct sk_buff *skb)
1262
+ const struct sk_buff *skb)
12301263 {
12311264 struct nfc_llcp_sock *llcp_sock;
1232
- u8 dsap, ssap, *tlv, type, length, tid, sap;
1265
+ u8 dsap, ssap, type, length, tid, sap;
1266
+ const u8 *tlv;
12331267 u16 tlv_len, offset;
1234
- char *service_name;
1268
+ const char *service_name;
12351269 size_t service_name_len;
12361270 struct nfc_llcp_sdp_tlv *sdp;
12371271 HLIST_HEAD(llc_sdres_list);
....@@ -1522,6 +1556,8 @@
15221556
15231557 __nfc_llcp_recv(local, skb);
15241558
1559
+ nfc_llcp_local_put(local);
1560
+
15251561 return 0;
15261562 }
15271563
....@@ -1538,6 +1574,8 @@
15381574
15391575 /* Close and purge all existing sockets */
15401576 nfc_llcp_socket_release(local, true, 0);
1577
+
1578
+ nfc_llcp_local_put(local);
15411579 }
15421580
15431581 void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
....@@ -1563,6 +1601,8 @@
15631601 mod_timer(&local->link_timer,
15641602 jiffies + msecs_to_jiffies(local->remote_lto));
15651603 }
1604
+
1605
+ nfc_llcp_local_put(local);
15661606 }
15671607
15681608 int nfc_llcp_register_device(struct nfc_dev *ndev)
....@@ -1606,14 +1646,16 @@
16061646 timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0);
16071647 INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work);
16081648
1649
+ spin_lock(&llcp_devices_lock);
16091650 list_add(&local->list, &llcp_devices);
1651
+ spin_unlock(&llcp_devices_lock);
16101652
16111653 return 0;
16121654 }
16131655
16141656 void nfc_llcp_unregister_device(struct nfc_dev *dev)
16151657 {
1616
- struct nfc_llcp_local *local = nfc_llcp_find_local(dev);
1658
+ struct nfc_llcp_local *local = nfc_llcp_remove_local(dev);
16171659
16181660 if (local == NULL) {
16191661 pr_debug("No such device\n");