1 files changed, 21 insertions, 0 deletions

diff --git a/drivers/nfc/st21nfca/st21nfca_se.c b/drivers/nfc/st21nfca/st21nfca_se.c
index 9b93d3904ab5..bd13cac9c66a 100644
--- a/drivers/nfc/st21nfca/st21nfca_se.c
+++ b/drivers/nfc/st21nfca/st21nfca_se.c
@@ -301,6 +301,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
                                 u8 event, struct sk_buff *skb)
 {
         int r = 0;
+        struct device *dev = &hdev->ndev->dev;
+        struct nfc_evt_transaction *transaction;
 
         pr_debug("connectivity gate event: %x\n", event);
 
@@ -308,6 +310,25 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
         case ST21NFCA_EVT_CONNECTIVITY:
                 break;
         case ST21NFCA_EVT_TRANSACTION:
+                if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
+                    skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
+                        return -EPROTO;
+
+                transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+                                                   skb->len - 2, GFP_KERNEL);
+
+                transaction->aid_len = skb->data[1];
+                memcpy(transaction->aid, &skb->data[2], skb->data[1]);
+
+                if (skb->data[transaction->aid_len + 2] !=
+                    NFC_EVT_TRANSACTION_PARAMS_TAG)
+                        return -EPROTO;
+
+                transaction->params_len = skb->data[transaction->aid_len + 3];
+                memcpy(transaction->params, skb->data +
+                       transaction->aid_len + 4, transaction->params_len);
+
+                r = nfc_se_transaction(hdev->ndev, host, transaction);
                 break;
         default:
                 return 1;