Unverified Commit 5f3b4246 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11426 nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Kaixiong Yu <yukaixiong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DLOCLSBRIIIN3S6JYCYCRU3CHDCCOFG5/ 
fix CVE-2023-52907

Fedor Pchelkin (1):
  nfc: pn533: initialize struct pn533_out_arg properly

Minsuk Kang (1):
  nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IALIN1 
 
Link:https://gitee.com/openeuler/kernel/pulls/11426

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents e7d0ff1a baf7b4cc

drivers/nfc/pn533/usb.c

+42 −3
Original line number Diff line number Diff line
@@ -165,10 +165,17 @@ static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags) 
	return usb_submit_urb(phy->ack_urb, flags);

}



struct pn533_out_arg {

	struct pn533_usb_phy *phy;

	struct completion done;

};



static int pn533_usb_send_frame(struct pn533 *dev,

				struct sk_buff *out)

{

	struct pn533_usb_phy *phy = dev->phy;

	struct pn533_out_arg arg;

	void *cntx;

	int rc;



	if (phy->priv == NULL)
@@ -180,10 +187,18 @@ static int pn533_usb_send_frame(struct pn533 *dev, 
	print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,

			     out->data, out->len, false);



	arg.phy = phy;

	init_completion(&arg.done);

	cntx = phy->out_urb->context;

	phy->out_urb->context = &arg;



	rc = usb_submit_urb(phy->out_urb, GFP_KERNEL);

	if (rc)

		return rc;



	wait_for_completion(&arg.done);

	phy->out_urb->context = cntx;



	if (dev->protocol_type == PN533_PROTO_REQ_RESP) {

		/* request for response for sent packet directly */

		rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
@@ -424,7 +439,31 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy) 
	return arg.rc;

}



static void pn533_send_complete(struct urb *urb)

static void pn533_out_complete(struct urb *urb)

{

	struct pn533_out_arg *arg = urb->context;

	struct pn533_usb_phy *phy = arg->phy;



	switch (urb->status) {

	case 0:

		break; /* success */

	case -ECONNRESET:

	case -ENOENT:

		dev_dbg(&phy->udev->dev,

			"The urb has been stopped (status %d)\n",

			urb->status);

		break;

	case -ESHUTDOWN:

	default:

		nfc_err(&phy->udev->dev,

			"Urb failure (status %d)\n",

			urb->status);

	}



	complete(&arg->done);

}



static void pn533_ack_complete(struct urb *urb)

{

	struct pn533_usb_phy *phy = urb->context;
@@ -512,10 +551,10 @@ static int pn533_usb_probe(struct usb_interface *interface, 


	usb_fill_bulk_urb(phy->out_urb, phy->udev,

			  usb_sndbulkpipe(phy->udev, out_endpoint),

			  NULL, 0, pn533_send_complete, phy);

			  NULL, 0, pn533_out_complete, phy);

	usb_fill_bulk_urb(phy->ack_urb, phy->udev,

			  usb_sndbulkpipe(phy->udev, out_endpoint),

			  NULL, 0, pn533_send_complete, phy);

			  NULL, 0, pn533_ack_complete, phy);



	switch (id->driver_info) {

	case PN533_DEVICE_STD: