aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/nfc/st21nfcb/st21nfcb_se.c23
1 files changed, 22 insertions, 1 deletions
diff --git a/drivers/nfc/st21nfcb/st21nfcb_se.c b/drivers/nfc/st21nfcb/st21nfcb_se.c
index f7977a47c047..9f4d8b744f32 100644
--- a/drivers/nfc/st21nfcb/st21nfcb_se.c
+++ b/drivers/nfc/st21nfcb/st21nfcb_se.c
@@ -311,14 +311,35 @@ static int st21nfcb_hci_connectivity_event_received(struct nci_dev *ndev,
311 struct sk_buff *skb) 311 struct sk_buff *skb)
312{ 312{
313 int r = 0; 313 int r = 0;
314 struct device *dev = &ndev->nfc_dev->dev;
315 struct nfc_evt_transaction *transaction;
314 316
315 pr_debug("connectivity gate event: %x\n", event); 317 pr_debug("connectivity gate event: %x\n", event);
316 318
317 switch (event) { 319 switch (event) {
318 case ST21NFCB_EVT_CONNECTIVITY: 320 case ST21NFCB_EVT_CONNECTIVITY:
321
319 break; 322 break;
320 case ST21NFCB_EVT_TRANSACTION: 323 case ST21NFCB_EVT_TRANSACTION:
321 break; 324 if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
325 skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
326 return -EPROTO;
327
328 transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
329 skb->len - 2, GFP_KERNEL);
330
331 transaction->aid_len = skb->data[1];
332 memcpy(transaction->aid, &skb->data[2], skb->data[1]);
333
334 if (skb->data[transaction->aid_len + 2] !=
335 NFC_EVT_TRANSACTION_PARAMS_TAG)
336 return -EPROTO;
337
338 transaction->params_len = skb->data[transaction->aid_len + 3];
339 memcpy(transaction->params, skb->data +
340 transaction->aid_len + 4, transaction->params_len);
341
342 r = nfc_se_transaction(ndev->nfc_dev, host, transaction);
322 default: 343 default:
323 return 1; 344 return 1;
324 } 345 }