diff options
| author | Frank Li <Frank.Li@freescale.com> | 2010-08-09 17:26:11 +0800 |
|---|---|---|
| committer | Frank Li <Frank.Li@freescale.com> | 2010-08-10 10:08:16 +0800 |
| commit | 70f671bf5f3d47bd6721758666e97cf5e7f162d1 (patch) | |
| tree | 2ef2768ee2df2f278329bda7f6e904a85b5697d4 | |
| parent | c22f73a5e3251d68e028d34c1f2f39eef63950f9 (diff) | |
ENGR000123347 CAN: Fix crash when transfer 8Byte follow 7Byte
Max Data length of can frame is 8 Byte. If previous transfer size
is 8, the length will exceed 8 if next package data size is 7 byte.
0x8|0x7 = 0xF, length will be 0xf then kernal oops happen.
Signed-off-by: Frank Li <Frank.Li@freescale.com>
(cherry picked from commit 266cc3624998507569cd98130b5030b195b7472d)
| -rw-r--r-- | drivers/net/can/flexcan/mbm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/flexcan/mbm.c b/drivers/net/can/flexcan/mbm.c index 42266e719ce3..c846d97daadb 100644 --- a/drivers/net/can/flexcan/mbm.c +++ b/drivers/net/can/flexcan/mbm.c @@ -294,7 +294,7 @@ int flexcan_mbm_xmit(struct flexcan_device *flexcan, struct can_frame *frame) hwmb[i].mb_id = (frame->can_id & CAN_SFF_MASK) << 18; } - hwmb[i].mb_cs &= MB_CS_LENGTH_MASK; + hwmb[i].mb_cs &= ~MB_CS_LENGTH_MASK; hwmb[i].mb_cs |= frame->can_dlc << MB_CS_LENGTH_OFFSET; flexcan_memcpy(hwmb[i].mb_data, frame->data, frame->can_dlc); hwmb[i].mb_cs &= ~MB_CS_CODE_MASK; |