[PATCH net 0/2] nfc: digital: fix two bugs in NFC-DEP chaining and frame handling

Patch 1 fixes a guaranteed kernel panic (skb_under_panic) caused by
pushing protocol headers into a chaining_skb allocated with only
1 byte of headroom.  Both initiator and target paths are affected.
Switch to digital_skb_alloc() which reserves the same head and
tailroom used by every other send buffer in this file.

Patch 2 adds a length check in the ATR_RES completion callback
as hardening; the downstream handlers already validate, so the
practical impact is limited to misdirected dispatch on stale data.

Liu Chao (2):
  nfc: digital: reserve proper headroom for chaining_skb
  nfc: digital: check resp length in digital_tg_send_atr_res_complete()

 net/nfc/digital_dep.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)


base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
-- 
2.50.1