Commit e44c8f40 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'split-nfc-st21nfca-refactor-evt_transaction-into-3' 

Martin Faltesek says:

====================
Split "nfc: st21nfca: Refactor EVT_TRANSACTION" into 3

v2: https://lore.kernel.org/netdev/20220401180939.2025819-1-mfaltesek@google.com/
v1: https://lore.kernel.org/netdev/20220329175431.3175472-1-mfaltesek@google.com/
====================

Link: https://lore.kernel.org/r/20220607025729.1673212-1-mfaltesek@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 653926f6 f2e19b36

drivers/nfc/st21nfca/se.c

+30 −23
Original line number Diff line number Diff line
@@ -300,6 +300,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 
	int r = 0;

	struct device *dev = &hdev->ndev->dev;

	struct nfc_evt_transaction *transaction;

	u32 aid_len;

	u8 params_len;



	pr_debug("connectivity gate event: %x\n", event);
@@ -308,43 +310,48 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 
		r = nfc_se_connectivity(hdev->ndev, host);

	break;

	case ST21NFCA_EVT_TRANSACTION:

		/*

		 * According to specification etsi 102 622

		/* According to specification etsi 102 622

		 * 11.2.2.4 EVT_TRANSACTION Table 52

		 * Description	Tag	Length

		 * AID		81	5 to 16

		 * PARAMETERS	82	0 to 255

		 *

		 * The key differences are aid storage length is variably sized

		 * in the packet, but fixed in nfc_evt_transaction, and that the aid_len

		 * is u8 in the packet, but u32 in the structure, and the tags in

		 * the packet are not included in nfc_evt_transaction.

		 *

		 * size in bytes: 1          1       5-16 1             1           0-255

		 * offset:        0          1       2    aid_len + 2   aid_len + 3 aid_len + 4

		 * member name:   aid_tag(M) aid_len aid  params_tag(M) params_len  params

		 * example:       0x81       5-16    X    0x82 0-255    X

		 */

		if (skb->len < NFC_MIN_AID_LENGTH + 2 &&

		    skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)

		if (skb->len < 2 || skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)

			return -EPROTO;



		transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL);

		if (!transaction)

			return -ENOMEM;

		aid_len = skb->data[1];



		transaction->aid_len = skb->data[1];



		/* Checking if the length of the AID is valid */

		if (transaction->aid_len > sizeof(transaction->aid))

			return -EINVAL;

		if (skb->len < aid_len + 4 || aid_len > sizeof(transaction->aid))

			return -EPROTO;



		memcpy(transaction->aid, &skb->data[2],

		       transaction->aid_len);

		params_len = skb->data[aid_len + 3];



		/* Check next byte is PARAMETERS tag (82) */

		if (skb->data[transaction->aid_len + 2] !=

		    NFC_EVT_TRANSACTION_PARAMS_TAG)

		/* Verify PARAMETERS tag is (82), and final check that there is enough

		 * space in the packet to read everything.

		 */

		if ((skb->data[aid_len + 2] != NFC_EVT_TRANSACTION_PARAMS_TAG) ||

		    (skb->len < aid_len + 4 + params_len))

			return -EPROTO;



		transaction->params_len = skb->data[transaction->aid_len + 3];

		transaction = devm_kzalloc(dev, sizeof(*transaction) + params_len, GFP_KERNEL);

		if (!transaction)

			return -ENOMEM;



		/* Total size is allocated (skb->len - 2) minus fixed array members */

		if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))

			return -EINVAL;

		transaction->aid_len = aid_len;

		transaction->params_len = params_len;



		memcpy(transaction->params, skb->data +

		       transaction->aid_len + 4, transaction->params_len);

		memcpy(transaction->aid, &skb->data[2], aid_len);

		memcpy(transaction->params, &skb->data[aid_len + 4], params_len);



		r = nfc_se_transaction(hdev->ndev, host, transaction);

	break;