| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * Secure Element driver for STMicroelectronics NFC NCI chip |
|---|
| 3 | 4 | * |
|---|
| 4 | 5 | * Copyright (C) 2014-2015 STMicroelectronics SAS. All rights reserved. |
|---|
| 5 | | - * |
|---|
| 6 | | - * This program is free software; you can redistribute it and/or modify it |
|---|
| 7 | | - * under the terms and conditions of the GNU General Public License, |
|---|
| 8 | | - * version 2, as published by the Free Software Foundation. |
|---|
| 9 | | - * |
|---|
| 10 | | - * This program is distributed in the hope that it will be useful, |
|---|
| 11 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 12 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 13 | | - * GNU General Public License for more details. |
|---|
| 14 | | - * |
|---|
| 15 | | - * You should have received a copy of the GNU General Public License |
|---|
| 16 | | - * along with this program; if not, see <http://www.gnu.org/licenses/>. |
|---|
| 17 | 6 | */ |
|---|
| 18 | 7 | |
|---|
| 19 | 8 | #include <linux/module.h> |
|---|
| .. | .. |
|---|
| 338 | 327 | * AID 81 5 to 16 |
|---|
| 339 | 328 | * PARAMETERS 82 0 to 255 |
|---|
| 340 | 329 | */ |
|---|
| 341 | | - if (skb->len < NFC_MIN_AID_LENGTH + 2 && |
|---|
| 330 | + if (skb->len < NFC_MIN_AID_LENGTH + 2 || |
|---|
| 342 | 331 | skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) |
|---|
| 343 | 332 | return -EPROTO; |
|---|
| 344 | 333 | |
|---|
| 345 | | - transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, |
|---|
| 346 | | - skb->len - 2, GFP_KERNEL); |
|---|
| 334 | + transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL); |
|---|
| 347 | 335 | if (!transaction) |
|---|
| 348 | 336 | return -ENOMEM; |
|---|
| 349 | 337 | |
|---|
| .. | .. |
|---|
| 352 | 340 | |
|---|
| 353 | 341 | /* Check next byte is PARAMETERS tag (82) */ |
|---|
| 354 | 342 | if (skb->data[transaction->aid_len + 2] != |
|---|
| 355 | | - NFC_EVT_TRANSACTION_PARAMS_TAG) |
|---|
| 343 | + NFC_EVT_TRANSACTION_PARAMS_TAG) { |
|---|
| 344 | + devm_kfree(dev, transaction); |
|---|
| 356 | 345 | return -EPROTO; |
|---|
| 346 | + } |
|---|
| 357 | 347 | |
|---|
| 358 | 348 | transaction->params_len = skb->data[transaction->aid_len + 3]; |
|---|
| 359 | 349 | memcpy(transaction->params, skb->data + |
|---|