Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 500c4ef0 authored by Christophe Ricard's avatar Christophe Ricard Committed by Samuel Ortiz
Browse files

NFC: nci: Fix incorrect data chaining when sending data 



When sending HCI data over NCI, cmd information should be
present only on the first packet.
Each packet shall be specifically allocated and sent to the
NCI layer.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarChristophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
parent a1269dd1

net/nfc/nci/hci.c

+13 −7
Original line number Diff line number Diff line
@@ -146,18 +146,18 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, 
	if (!conn_info)

		return -EPROTO;



	skb = nci_skb_alloc(ndev, 2 + conn_info->max_pkt_payload_len +

	i = 0;

	skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +

			    NCI_DATA_HDR_SIZE, GFP_KERNEL);

	if (!skb)

		return -ENOMEM;



	skb_reserve(skb, 2 + NCI_DATA_HDR_SIZE);

	skb_reserve(skb, NCI_DATA_HDR_SIZE + 2);

	*skb_push(skb, 1) = data_type;



	i = 0;

	do {

		len = conn_info->max_pkt_payload_len;



	do {

		/* If last packet add NCI_HFP_NO_CHAINING */

		if (i + conn_info->max_pkt_payload_len -

		    (skb->len + 1) >= data_len) {
@@ -177,9 +177,15 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, 
			return r;



		i += len;



		if (i < data_len) {

			skb_trim(skb, 0);

			skb_pull(skb, len);

			skb = nci_skb_alloc(ndev,

					    conn_info->max_pkt_payload_len +

					    NCI_DATA_HDR_SIZE, GFP_KERNEL);

			if (!skb)

				return -ENOMEM;



			skb_reserve(skb, NCI_DATA_HDR_SIZE + 1);

		}

	} while (i < data_len);