In the j1939_xtp_rx_dat_one() function, there are 2 variables (skb and se_skb) holding a skb. The control buffer of the skbs is accessed one after the other, but using the same "skcb" variable. To avoid confusion introduce a new variable "se_skcb" to access the se_skb's control buffer as done in the rest of this file, too. Cc: Robin van der Gracht <robin@xxxxxxxxxxx> Cc: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx> --- net/can/j1939/transport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index d6b78da2a986..bbac0e321716 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1747,7 +1747,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, struct sk_buff *skb) { struct j1939_priv *priv = session->priv; - struct j1939_sk_buff_cb *skcb; + struct j1939_sk_buff_cb *skcb, *se_skcb; struct sk_buff *se_skb; const u8 *dat; u8 *tpdat; @@ -1798,8 +1798,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, goto out_session_cancel; } - skcb = j1939_skb_to_cb(se_skb); - offset = packet * 7 - skcb->offset; + se_skcb = j1939_skb_to_cb(se_skb); + offset = packet * 7 - se_skcb->offset; nbytes = se_skb->len - offset; if (nbytes > 7) nbytes = 7; @@ -1827,7 +1827,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, if (packet == session->pkt.rx) session->pkt.rx++; - if (skcb->addr.type != J1939_ETP && + if (se_skcb->addr.type != J1939_ETP && j1939_cb_is_broadcast(&session->skcb)) { if (session->pkt.rx >= session->pkt.total) final = true; -- 2.30.2