.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | /* |
---|
2 | 3 | * Secure Element driver for STMicroelectronics NFC NCI chip |
---|
3 | 4 | * |
---|
4 | 5 | * Copyright (C) 2014-2015 STMicroelectronics SAS. All rights reserved. |
---|
5 | | - * |
---|
6 | | - * This program is free software; you can redistribute it and/or modify it |
---|
7 | | - * under the terms and conditions of the GNU General Public License, |
---|
8 | | - * version 2, as published by the Free Software Foundation. |
---|
9 | | - * |
---|
10 | | - * This program is distributed in the hope that it will be useful, |
---|
11 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
12 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
13 | | - * GNU General Public License for more details. |
---|
14 | | - * |
---|
15 | | - * You should have received a copy of the GNU General Public License |
---|
16 | | - * along with this program; if not, see <http://www.gnu.org/licenses/>. |
---|
17 | 6 | */ |
---|
18 | 7 | |
---|
19 | 8 | #include <linux/module.h> |
---|
.. | .. |
---|
338 | 327 | * AID 81 5 to 16 |
---|
339 | 328 | * PARAMETERS 82 0 to 255 |
---|
340 | 329 | */ |
---|
341 | | - if (skb->len < NFC_MIN_AID_LENGTH + 2 && |
---|
| 330 | + if (skb->len < NFC_MIN_AID_LENGTH + 2 || |
---|
342 | 331 | skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) |
---|
343 | 332 | return -EPROTO; |
---|
344 | 333 | |
---|
345 | | - transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, |
---|
346 | | - skb->len - 2, GFP_KERNEL); |
---|
| 334 | + transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL); |
---|
347 | 335 | if (!transaction) |
---|
348 | 336 | return -ENOMEM; |
---|
349 | 337 | |
---|
.. | .. |
---|
352 | 340 | |
---|
353 | 341 | /* Check next byte is PARAMETERS tag (82) */ |
---|
354 | 342 | if (skb->data[transaction->aid_len + 2] != |
---|
355 | | - NFC_EVT_TRANSACTION_PARAMS_TAG) |
---|
| 343 | + NFC_EVT_TRANSACTION_PARAMS_TAG) { |
---|
| 344 | + devm_kfree(dev, transaction); |
---|
356 | 345 | return -EPROTO; |
---|
| 346 | + } |
---|
357 | 347 | |
---|
358 | 348 | transaction->params_len = skb->data[transaction->aid_len + 3]; |
---|
359 | 349 | memcpy(transaction->params, skb->data + |
---|