Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3a4bfde authored by Wolfgang Grandegger's avatar Wolfgang Grandegger Committed by David S. Miller
Browse files

mscan: too much data copied to CAN frame due to 16 bit accesses 



Due to the 16 bit access to mscan registers there's too much data copied to
the zero initialized CAN frame when having an odd number of bytes to copy.
This patch ensures that only the requested bytes are copied by using an
8 bit access for the remaining byte.

Reported-by: default avatarAndre Naujoks <nautsch@gmail.com>
Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: default avatarWolfgang Grandegger <wg@grandegger.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cdaf5570

drivers/net/can/mscan/mscan.c

+8 −3
Original line number Original line Diff line number Diff line
@@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(struct sk_buff *skb, struct net_device *dev) 
		void __iomem *data = &regs->tx.dsr1_0;

		void __iomem *data = &regs->tx.dsr1_0;

		u16 *payload = (u16 *)frame->data;

		u16 *payload = (u16 *)frame->data;





		/* It is safe to write into dsr[dlc+1] */

		for (i = 0; i < frame->can_dlc / 2; i++) {

		for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {

			out_be16(data, *payload++);

			out_be16(data, *payload++);

			data += 2 + _MSCAN_RESERVED_DSR_SIZE;

			data += 2 + _MSCAN_RESERVED_DSR_SIZE;

		}

		}

		/* write remaining byte if necessary */

		if (frame->can_dlc & 1)

			out_8(data, frame->data[frame->can_dlc - 1]);

	}

	}





	out_8(&regs->tx.dlr, frame->can_dlc);

	out_8(&regs->tx.dlr, frame->can_dlc);
@@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct net_device *dev, struct can_frame *frame) 
		void __iomem *data = &regs->rx.dsr1_0;

		void __iomem *data = &regs->rx.dsr1_0;

		u16 *payload = (u16 *)frame->data;

		u16 *payload = (u16 *)frame->data;





		for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {

		for (i = 0; i < frame->can_dlc / 2; i++) {

			*payload++ = in_be16(data);

			*payload++ = in_be16(data);

			data += 2 + _MSCAN_RESERVED_DSR_SIZE;

			data += 2 + _MSCAN_RESERVED_DSR_SIZE;

		}

		}

		/* read remaining byte if necessary */

		if (frame->can_dlc & 1)

			frame->data[frame->can_dlc - 1] = in_8(data);

	}

	}





	out_8(&regs->canrflg, MSCAN_RXF);

	out_8(&regs->canrflg, MSCAN_RXF);