Patch "NFC: st-nci: Fix incorrect spi buffer size" has been added to the 4.3-stable tree

This is a note to let you know that I've just added the patch titled

NFC: st-nci: Fix incorrect spi buffer size

to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfc-st-nci-fix-incorrect-spi-buffer-size.patch
and it can be found in the queue-4.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Christophe Ricard <[email protected]>
Date: Sun, 25 Oct 2015 22:54:19 +0100
Subject: NFC: st-nci: Fix incorrect spi buffer size

From: Christophe Ricard <[email protected]>

commit a1269dd116319335db6d73013a31c038486c813e upstream.

When sending data over SPI, the maximum expected length is the maximum nci packet payload + data header size + the frame head room (1 for the ndlc header) + the frame trail room (0).

---
 drivers/nfc/st-nci/spi.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -25,6 +25,7 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/nfc.h>
+#include <net/nfc/nci.h>
 #include <linux/platform_data/st-nci.h>
 
 #include "ndlc.h"

@@ -94,7 +95,8 @@ static int st_nci_spi_write(void *phy_id
 	struct st_nci_spi_phy *phy = phy_id;
 	struct spi_device *dev = phy->spi_dev;
 	struct sk_buff *skb_rx;
-	u8 buf[ST_NCI_SPI_MAX_SIZE];
+	u8 buf[ST_NCI_SPI_MAX_SIZE + NCI_DATA_HDR_SIZE +
+	       ST_NCI_FRAME_HEADROOM + ST_NCI_FRAME_TAILROOM];
 	struct spi_transfer spi_xfer = {
 		.tx_buf = skb->data,
 		.rx_buf = buf,

Patches currently in stable-queue which might be from [email protected] are

queue-4.3/nfc-nci-extract-pipe-value-using-nci_hcp_msg_get_pipe.patch queue-4.3/nfc-nci-fix-incorrect-data-chaining-when-sending-data.patch queue-4.3/nfc-st-nci-fix-incorrect-spi-buffer-size.patch queue-4.3/nfc-nci-fix-improper-management-of-hci-return-code.patch