Patch "NFC: nci: Fix incorrect data chaining when sending data" has been added to the 4.3-stable tree

This is a note to let you know that I've just added the patch titled

NFC: nci: Fix incorrect data chaining when sending data

to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfc-nci-fix-incorrect-data-chaining-when-sending-data.patch
and it can be found in the queue-4.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Christophe Ricard <[email protected]>
Date: Sun, 25 Oct 2015 22:54:20 +0100
Subject: NFC: nci: Fix incorrect data chaining when sending data

From: Christophe Ricard <[email protected]>

commit 500c4ef02277eaadbfe20537f963b6221f6ac007 upstream.

When sending HCI data over NCI, cmd information should be present only on the first packet.
Each packet shall be specifically allocated and sent to the NCI layer.

---
 net/nfc/nci/hci.c |   20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

@@ -146,18 +146,18 @@ static int nci_hci_send_data(struct nci_
 	if (!conn_info)
 		return -EPROTO;
 
-	skb = nci_skb_alloc(ndev, 2 + conn_info->max_pkt_payload_len +
+	i = 0;
+	skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +
 			    NCI_DATA_HDR_SIZE, GFP_KERNEL);
 	if (!skb)
 		return -ENOMEM;
 
-	skb_reserve(skb, 2 + NCI_DATA_HDR_SIZE);
+	skb_reserve(skb, NCI_DATA_HDR_SIZE + 2);
 	*skb_push(skb, 1) = data_type;
 
-	i = 0;
-	len = conn_info->max_pkt_payload_len;
-
 	do {
+		len = conn_info->max_pkt_payload_len;
+
 		/* If last packet add NCI_HFP_NO_CHAINING */
 		if (i + conn_info->max_pkt_payload_len -
 		    (skb->len + 1) >= data_len) {

@@ -177,9 +177,15 @@ static int nci_hci_send_data(struct nci_
 			return r;
 
 		i += len;
+
 		if (i < data_len) {
-			skb_trim(skb, 0);
-			skb_pull(skb, len);
+			skb = nci_skb_alloc(ndev,
+					    conn_info->max_pkt_payload_len +
+					    NCI_DATA_HDR_SIZE, GFP_KERNEL);
+			if (!skb)
+				return -ENOMEM;
+
+			skb_reserve(skb, NCI_DATA_HDR_SIZE + 1);
 		}
 	} while (i < data_len);
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.3/nfc-nci-extract-pipe-value-using-nci_hcp_msg_get_pipe.patch queue-4.3/nfc-nci-fix-incorrect-data-chaining-when-sending-data.patch queue-4.3/nfc-st-nci-fix-incorrect-spi-buffer-size.patch queue-4.3/nfc-nci-fix-improper-management-of-hci-return-code.patch