aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/can
diff options
context:
space:
mode:
authorWolfgang Grandegger <wg@grandegger.com>2011-10-07 05:28:14 -0400
committerDavid S. Miller <davem@davemloft.net>2011-10-10 14:31:00 -0400
commita3a4bfde8a271df7ee56fcf31b8d907d50e7f216 (patch)
treea9ef98f3da1e449b0a430705ab8b9abea036467b /drivers/net/can
parentcdaf557034bb4397b2c86bb424de1788b134f610 (diff)
mscan: too much data copied to CAN frame due to 16 bit accesses
Due to the 16 bit access to mscan registers there's too much data copied to the zero initialized CAN frame when having an odd number of bytes to copy. This patch ensures that only the requested bytes are copied by using an 8 bit access for the remaining byte. Reported-by: Andre Naujoks <nautsch@gmail.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/can')
-rw-r--r--drivers/net/can/mscan/mscan.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
index 92feac68b66e..4cc6f44c2ba2 100644
--- a/drivers/net/can/mscan/mscan.c
+++ b/drivers/net/can/mscan/mscan.c
@@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(struct sk_buff *skb, struct net_device *dev)
261 void __iomem *data = &regs->tx.dsr1_0; 261 void __iomem *data = &regs->tx.dsr1_0;
262 u16 *payload = (u16 *)frame->data; 262 u16 *payload = (u16 *)frame->data;
263 263
264 /* It is safe to write into dsr[dlc+1] */ 264 for (i = 0; i < frame->can_dlc / 2; i++) {
265 for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
266 out_be16(data, *payload++); 265 out_be16(data, *payload++);
267 data += 2 + _MSCAN_RESERVED_DSR_SIZE; 266 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
268 } 267 }
268 /* write remaining byte if necessary */
269 if (frame->can_dlc & 1)
270 out_8(data, frame->data[frame->can_dlc - 1]);
269 } 271 }
270 272
271 out_8(&regs->tx.dlr, frame->can_dlc); 273 out_8(&regs->tx.dlr, frame->can_dlc);
@@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct net_device *dev, struct can_frame *frame)
330 void __iomem *data = &regs->rx.dsr1_0; 332 void __iomem *data = &regs->rx.dsr1_0;
331 u16 *payload = (u16 *)frame->data; 333 u16 *payload = (u16 *)frame->data;
332 334
333 for (i = 0; i < (frame->can_dlc + 1) / 2; i++) { 335 for (i = 0; i < frame->can_dlc / 2; i++) {
334 *payload++ = in_be16(data); 336 *payload++ = in_be16(data);
335 data += 2 + _MSCAN_RESERVED_DSR_SIZE; 337 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
336 } 338 }
339 /* read remaining byte if necessary */
340 if (frame->can_dlc & 1)
341 frame->data[frame->can_dlc - 1] = in_8(data);
337 } 342 }
338 343
339 out_8(&regs->canrflg, MSCAN_RXF); 344 out_8(&regs->canrflg, MSCAN_RXF);