summaryrefslogtreecommitdiff
path: root/drivers/nfc/st-nci
diff options
context:
space:
mode:
authorChristophe Ricard <christophe.ricard@gmail.com>2015-10-25 22:54:19 +0100
committerSamuel Ortiz <sameo@linux.intel.com>2015-10-26 06:53:06 +0100
commita1269dd116319335db6d73013a31c038486c813e (patch)
tree656eefa06de222440aa69f705d4314bc432a0eba /drivers/nfc/st-nci
parent1c54795da05a792e495387317240625696d37abd (diff)
NFC: st-nci: Fix incorrect spi buffer size
When sending data over SPI, the maximum expected length is the maximum nci packet payload + data header size + the frame head room (1 for the ndlc header) + the frame trail room (0). Cc: stable@vger.kernel.org Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Diffstat (limited to 'drivers/nfc/st-nci')
-rw-r--r--drivers/nfc/st-nci/spi.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/nfc/st-nci/spi.c b/drivers/nfc/st-nci/spi.c
index 9a398713897f..b43f448b8d78 100644
--- a/drivers/nfc/st-nci/spi.c
+++ b/drivers/nfc/st-nci/spi.c
@@ -25,6 +25,7 @@
#include <linux/interrupt.h>
#include <linux/delay.h>
#include <linux/nfc.h>
+#include <net/nfc/nci.h>
#include <linux/platform_data/st-nci.h>
#include "st-nci.h"
@@ -94,7 +95,8 @@ static int st_nci_spi_write(void *phy_id, struct sk_buff *skb)
struct st_nci_spi_phy *phy = phy_id;
struct spi_device *dev = phy->spi_dev;
struct sk_buff *skb_rx;
- u8 buf[ST_NCI_SPI_MAX_SIZE];
+ u8 buf[ST_NCI_SPI_MAX_SIZE + NCI_DATA_HDR_SIZE +
+ ST_NCI_FRAME_HEADROOM + ST_NCI_FRAME_TAILROOM];
struct spi_transfer spi_xfer = {
.tx_buf = skb->data,
.rx_buf = buf,