Merge branch 'for-next' of https://codeberg.org/linux-nfc/linux.git

# Conflicts:
#	net/nfc/nci/rsp.c

1 files changed, 9 insertions, 0 deletions

diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index 6b2fa6bdbd14..dd6f16f49ceb 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -50,6 +50,7 @@ static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev,
 	const struct nci_core_init_rsp_1 *rsp_1 = (void *)skb->data;
 	const struct nci_core_init_rsp_2 *rsp_2;
 
+	/* Ensure that the status field can be accessed. */
 	if (skb->len < sizeof(*rsp_1))
 		return NCI_STATUS_SYNTAX_ERROR;
 
@@ -114,6 +115,12 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev,
 	if (rsp->status != NCI_STATUS_OK)
 		return rsp->status;
 
+	/* Success response must contain the full fixed-size header */
+	if (skb_headlen(skb) < sizeof(*rsp))
+		return NCI_STATUS_SYNTAX_ERROR;
+
+	supported_rf_interface = rsp->supported_rf_interfaces;
+
 	ndev->nfcc_features = __le32_to_cpu(rsp->nfcc_features);
 	ndev->num_supported_rf_interfaces = rsp->num_supported_rf_interfaces;
 
@@ -135,6 +142,8 @@ static u8 nci_core_init_rsp_packet_v2(struct nci_dev *ndev,
 		supported_rf_interface += rf_extension_cnt;
 	}
 
+	ndev->num_supported_rf_interfaces = rf_interface_idx;
+
 	ndev->max_logical_connections = rsp->max_logical_connections;
 	ndev->max_routing_table_size =
 			__le16_to_cpu(rsp->max_routing_table_size);