Skip to contentSkip to conversation

mscan: too much data copied to CAN frame due to 16 bit accesses

PATCH Applied Wolfgang Grandegger 2 participants 2 messages Oct 7, 2011 – Oct 10, 2011 1 message not in the archive

Subsystems (3)
Networking Network drivers CAN network drivers
lore
Share & tools
lore

Wolfgang Grandegger

author
#0 lore raw

PATCH 1/1 mscan: too much data copied to CAN frame due to 16 bit accesses

Due to the 16 bit access to mscan registers there's too much data copied to the zero initialized CAN frame when having an odd number of bytes to copy. This patch ensures that only the requested bytes are copied by using an 8 bit access for the remaining byte.

Reported-by Andre Naujoks <[email protected]>
Signed-off-by Oliver Hartkopp <[email protected]>
Signed-off-by Wolfgang Grandegger <[email protected]>
---
 drivers/net/can/mscan/mscan.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)
drivers/net/can/mscan/mscan.c +8 -3
index ac42f5d..ec4a311 100644
@@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		void __iomem *data = &regs->tx.dsr1_0;
 		u16 *payload = (u16 *)frame->data;
 
-		/* It is safe to write into dsr[dlc+1] */
-		for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
+		for (i = 0; i < frame->can_dlc / 2; i++) {
 			out_be16(data, *payload++);
 			data += 2 + _MSCAN_RESERVED_DSR_SIZE;
 		}
+		/* write remaining byte if necessary */
+		if (frame->can_dlc & 1)
+			out_8(data, frame->data[frame->can_dlc - 1]);
 	}
 
 	out_8(&regs->tx.dlr, frame->can_dlc);

@@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct net_device *dev, struct can_frame *frame)
 		void __iomem *data = &regs->rx.dsr1_0;
 		u16 *payload = (u16 *)frame->data;
 
-		for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
+		for (i = 0; i < frame->can_dlc / 2; i++) {
 			*payload++ = in_be16(data);
 			data += 2 + _MSCAN_RESERVED_DSR_SIZE;
 		}
+		/* read remaining byte if necessary */
+		if (frame->can_dlc & 1)
+			frame->data[frame->can_dlc - 1] = in_8(data);
 	}
 
 	out_8(&regs->canrflg, MSCAN_RXF);
Signature · 1 line
1.7.4.1

A message that is not in the archive (sent off-list or not yet received): [email protected]

Applied
#2 lore raw

From: Wolfgang Grandegger <[email protected]>
Date: Fri, 07 Oct 2011 21:28:14 +0200

Quoted 8 lines

Due to the 16 bit access to mscan registers there's too much data copied to the zero initialized CAN frame when having an odd number of bytes to copy. This patch ensures that only the requested bytes are copied by using an 8 bit access for the remaining byte.

Reported-by Andre Naujoks <[email protected]>
Signed-off-by Oliver Hartkopp <[email protected]>
Signed-off-by Wolfgang Grandegger <[email protected]>

Applied, thanks everyone.