linux-kernel - [PATCH 06/11] NFC: pn533: usb: fix errors when poll is stopped

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 21 Apr 2016 16:43:54 +0200
From:	Michael Thalmeier <michael.thalmeier@...e.at>
To:	Samuel Ortiz <sameo@...ux.intel.com>
Cc:	Lauro Ramos Venancio <lauro.venancio@...nbossa.org>,
	Aloisio Almeida Jr <aloisio.almeida@...nbossa.org>,
	linux-kernel@...r.kernel.org, linux-nfc@...ts.01.org,
	michael@...lmeier.at
Subject: [PATCH 06/11] NFC: pn533: usb: fix errors when poll is stopped

When a poll ist stopped we need to kill the out_urb request too before
starting a new request.

Additionally check if cmd is set in pn533_recv_ack befor accessing its struct
members.

Signed-off-by: Michael Thalmeier <michael.thalmeier@...e.at>
---
 drivers/nfc/pn533/usb.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
index 8ca0603..5500175 100644
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -98,7 +98,8 @@ static void pn533_recv_ack(struct urb *urb)
 	struct pn533_std_frame *in_frame;
 	int rc;
 
-	cmd->status = urb->status;
+	if (cmd)
+		cmd->status = urb->status;
 
 	switch (urb->status) {
 	case 0:
@@ -120,7 +121,8 @@ static void pn533_recv_ack(struct urb *urb)
 
 	if (!pn533_rx_frame_is_ack(in_frame)) {
 		nfc_err(&phy->udev->dev, "Received an invalid ack\n");
-		cmd->status = -EIO;
+		if (cmd)
+			cmd->status = -EIO;
 		goto sched_wq;
 	}
 
@@ -128,7 +130,8 @@ static void pn533_recv_ack(struct urb *urb)
 	if (rc) {
 		nfc_err(&phy->udev->dev,
 			"usb_submit_urb failed with result %d\n", rc);
-		cmd->status = rc;
+		if (cmd)
+			cmd->status = rc;
 		goto sched_wq;
 	}
 
@@ -209,6 +212,9 @@ static void pn533_usb_abort_cmd(struct pn533 *dev, gfp_t flags)
 	if (dev->device_type == PN533_DEVICE_ACR122U)
 		return;
 
+	/* cancel the out urb request */
+	usb_kill_urb(phy->out_urb);
+
 	/* An ack will cancel the last issued command */
 	pn533_usb_send_ack(dev, flags);
 
-- 
2.5.5