Skip to content

Commit 51ee075

Browse files
kuba-mookuba-moo
committed
Merge tag 'linux-can-fixes-for-6.13-20241202' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says: ==================== pull-request: can 2024-12-02 The first patch is by me and allows the use of sleeping GPIOs to set termination GPIOs. Alexander Kozhinov fixes the gs_usb driver to use the endpoints provided by the usb endpoint descriptions instead of hard coded ones. Dario Binacchi contributes 11 statistics related patches for various CAN driver. A potential use after free in the hi311x is fixed. The statistics for the c_can, sun4i_can, hi311x, m_can, ifi_canfd, sja1000, sun4i_can, ems_usb, f81604 are fixed: update statistics even if the allocation of the error skb fails and fix the incrementing of the rx,tx error counters. A patch by me fixes the workaround for DS80000789E 6 erratum in the mcp251xfd driver. The last patch is by Dmitry Antipov, targets the j1939 CAN protocol and fixes a skb reference counting issue. * tag 'linux-can-fixes-for-6.13-20241202' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: j1939: j1939_session_new(): fix skb reference counting can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6. can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics can: hi311x: hi3110_can_ist(): update state error statistics if skb allocation fails can: hi311x: hi3110_can_ist(): fix potential use-after-free can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails can: gs_usb: add usb endpoint address detection at driver probe step can: dev: can_set_termination(): allow sleeping GPIOs ==================== Link: https://patch.msgid.link/20241202090040.1110280-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents c889aa2 + a8c6950 commit 51ee075

12 files changed

Lines changed: 253 additions & 134 deletions

File tree

‎drivers/net/can/c_can/c_can_main.c‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1014,49 +1014,57 @@ static int c_can_handle_bus_err(struct net_device *dev,
10141014

10151015
/* propagate the error condition to the CAN stack */
10161016
skb = alloc_can_err_skb(dev, &cf);
1017-
if (unlikely(!skb))
1018-
return 0;
10191017

10201018
/* check for 'last error code' which tells us the
10211019
* type of the last error to occur on the CAN bus
10221020
*/
1023-
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
1021+
if (likely(skb))
1022+
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
10241023

10251024
switch (lec_type) {
10261025
case LEC_STUFF_ERROR:
10271026
netdev_dbg(dev, "stuff error\n");
1028-
cf->data[2] |= CAN_ERR_PROT_STUFF;
1027+
if (likely(skb))
1028+
cf->data[2] |= CAN_ERR_PROT_STUFF;
10291029
stats->rx_errors++;
10301030
break;
10311031
case LEC_FORM_ERROR:
10321032
netdev_dbg(dev, "form error\n");
1033-
cf->data[2] |= CAN_ERR_PROT_FORM;
1033+
if (likely(skb))
1034+
cf->data[2] |= CAN_ERR_PROT_FORM;
10341035
stats->rx_errors++;
10351036
break;
10361037
case LEC_ACK_ERROR:
10371038
netdev_dbg(dev, "ack error\n");
1038-
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
1039+
if (likely(skb))
1040+
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
10391041
stats->tx_errors++;
10401042
break;
10411043
case LEC_BIT1_ERROR:
10421044
netdev_dbg(dev, "bit1 error\n");
1043-
cf->data[2] |= CAN_ERR_PROT_BIT1;
1045+
if (likely(skb))
1046+
cf->data[2] |= CAN_ERR_PROT_BIT1;
10441047
stats->tx_errors++;
10451048
break;
10461049
case LEC_BIT0_ERROR:
10471050
netdev_dbg(dev, "bit0 error\n");
1048-
cf->data[2] |= CAN_ERR_PROT_BIT0;
1051+
if (likely(skb))
1052+
cf->data[2] |= CAN_ERR_PROT_BIT0;
10491053
stats->tx_errors++;
10501054
break;
10511055
case LEC_CRC_ERROR:
10521056
netdev_dbg(dev, "CRC error\n");
1053-
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
1057+
if (likely(skb))
1058+
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
10541059
stats->rx_errors++;
10551060
break;
10561061
default:
10571062
break;
10581063
}
10591064

1065+
if (unlikely(!skb))
1066+
return 0;
1067+
10601068
netif_receive_skb(skb);
10611069
return 1;
10621070
}

‎drivers/net/can/dev/dev.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -468,7 +468,7 @@ static int can_set_termination(struct net_device *ndev, u16 term)
468468
else
469469
set = 0;
470470

471-
gpiod_set_value(priv->termination_gpio, set);
471+
gpiod_set_value_cansleep(priv->termination_gpio, set);
472472

473473
return 0;
474474
}

‎drivers/net/can/ifi_canfd/ifi_canfd.c‎

Lines changed: 40 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -390,43 +390,65 @@ static int ifi_canfd_handle_lec_err(struct net_device *ndev)
390390
return 0;
391391

392392
priv->can.can_stats.bus_error++;
393-
stats->rx_errors++;
394393

395394
/* Propagate the error condition to the CAN stack. */
396395
skb = alloc_can_err_skb(ndev, &cf);
397-
if (unlikely(!skb))
398-
return 0;
399396

400397
/* Read the error counter register and check for new errors. */
401-
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
398+
if (likely(skb))
399+
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
402400

403-
if (errctr & IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST)
404-
cf->data[2] |= CAN_ERR_PROT_OVERLOAD;
401+
if (errctr & IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST) {
402+
stats->rx_errors++;
403+
if (likely(skb))
404+
cf->data[2] |= CAN_ERR_PROT_OVERLOAD;
405+
}
405406

406-
if (errctr & IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST)
407-
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
407+
if (errctr & IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST) {
408+
stats->tx_errors++;
409+
if (likely(skb))
410+
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
411+
}
408412

409-
if (errctr & IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST)
410-
cf->data[2] |= CAN_ERR_PROT_BIT0;
413+
if (errctr & IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST) {
414+
stats->tx_errors++;
415+
if (likely(skb))
416+
cf->data[2] |= CAN_ERR_PROT_BIT0;
417+
}
411418

412-
if (errctr & IFI_CANFD_ERROR_CTR_BIT1_ERROR_FIRST)
413-
cf->data[2] |= CAN_ERR_PROT_BIT1;
419+
if (errctr & IFI_CANFD_ERROR_CTR_BIT1_ERROR_FIRST) {
420+
stats->tx_errors++;
421+
if (likely(skb))
422+
cf->data[2] |= CAN_ERR_PROT_BIT1;
423+
}
414424

415-
if (errctr & IFI_CANFD_ERROR_CTR_STUFF_ERROR_FIRST)
416-
cf->data[2] |= CAN_ERR_PROT_STUFF;
425+
if (errctr & IFI_CANFD_ERROR_CTR_STUFF_ERROR_FIRST) {
426+
stats->rx_errors++;
427+
if (likely(skb))
428+
cf->data[2] |= CAN_ERR_PROT_STUFF;
429+
}
417430

418-
if (errctr & IFI_CANFD_ERROR_CTR_CRC_ERROR_FIRST)
419-
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
431+
if (errctr & IFI_CANFD_ERROR_CTR_CRC_ERROR_FIRST) {
432+
stats->rx_errors++;
433+
if (likely(skb))
434+
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
435+
}
420436

421-
if (errctr & IFI_CANFD_ERROR_CTR_FORM_ERROR_FIRST)
422-
cf->data[2] |= CAN_ERR_PROT_FORM;
437+
if (errctr & IFI_CANFD_ERROR_CTR_FORM_ERROR_FIRST) {
438+
stats->rx_errors++;
439+
if (likely(skb))
440+
cf->data[2] |= CAN_ERR_PROT_FORM;
441+
}
423442

424443
/* Reset the error counter, ack the IRQ and re-enable the counter. */
425444
writel(IFI_CANFD_ERROR_CTR_ER_RESET, priv->base + IFI_CANFD_ERROR_CTR);
426445
writel(IFI_CANFD_INTERRUPT_ERROR_COUNTER,
427446
priv->base + IFI_CANFD_INTERRUPT);
428447
writel(IFI_CANFD_ERROR_CTR_ER_ENABLE, priv->base + IFI_CANFD_ERROR_CTR);
429448

449+
if (unlikely(!skb))
450+
return 0;
451+
430452
netif_receive_skb(skb);
431453

432454
return 1;

‎drivers/net/can/m_can/m_can.c‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -695,47 +695,60 @@ static int m_can_handle_lec_err(struct net_device *dev,
695695
u32 timestamp = 0;
696696

697697
cdev->can.can_stats.bus_error++;
698-
stats->rx_errors++;
699698

700699
/* propagate the error condition to the CAN stack */
701700
skb = alloc_can_err_skb(dev, &cf);
702-
if (unlikely(!skb))
703-
return 0;
704701

705702
/* check for 'last error code' which tells us the
706703
* type of the last error to occur on the CAN bus
707704
*/
708-
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
705+
if (likely(skb))
706+
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
709707

710708
switch (lec_type) {
711709
case LEC_STUFF_ERROR:
712710
netdev_dbg(dev, "stuff error\n");
713-
cf->data[2] |= CAN_ERR_PROT_STUFF;
711+
stats->rx_errors++;
712+
if (likely(skb))
713+
cf->data[2] |= CAN_ERR_PROT_STUFF;
714714
break;
715715
case LEC_FORM_ERROR:
716716
netdev_dbg(dev, "form error\n");
717-
cf->data[2] |= CAN_ERR_PROT_FORM;
717+
stats->rx_errors++;
718+
if (likely(skb))
719+
cf->data[2] |= CAN_ERR_PROT_FORM;
718720
break;
719721
case LEC_ACK_ERROR:
720722
netdev_dbg(dev, "ack error\n");
721-
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
723+
stats->tx_errors++;
724+
if (likely(skb))
725+
cf->data[3] = CAN_ERR_PROT_LOC_ACK;
722726
break;
723727
case LEC_BIT1_ERROR:
724728
netdev_dbg(dev, "bit1 error\n");
725-
cf->data[2] |= CAN_ERR_PROT_BIT1;
729+
stats->tx_errors++;
730+
if (likely(skb))
731+
cf->data[2] |= CAN_ERR_PROT_BIT1;
726732
break;
727733
case LEC_BIT0_ERROR:
728734
netdev_dbg(dev, "bit0 error\n");
729-
cf->data[2] |= CAN_ERR_PROT_BIT0;
735+
stats->tx_errors++;
736+
if (likely(skb))
737+
cf->data[2] |= CAN_ERR_PROT_BIT0;
730738
break;
731739
case LEC_CRC_ERROR:
732740
netdev_dbg(dev, "CRC error\n");
733-
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
741+
stats->rx_errors++;
742+
if (likely(skb))
743+
cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
734744
break;
735745
default:
736746
break;
737747
}
738748

749+
if (unlikely(!skb))
750+
return 0;
751+
739752
if (cdev->is_peripheral)
740753
timestamp = m_can_get_timestamp(cdev);
741754

‎drivers/net/can/sja1000/sja1000.c‎

Lines changed: 39 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -416,17 +416,18 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
416416
int ret = 0;
417417

418418
skb = alloc_can_err_skb(dev, &cf);
419-
if (skb == NULL)
420-
return -ENOMEM;
421419

422420
txerr = priv->read_reg(priv, SJA1000_TXERR);
423421
rxerr = priv->read_reg(priv, SJA1000_RXERR);
424422

425423
if (isrc & IRQ_DOI) {
426424
/* data overrun interrupt */
427425
netdev_dbg(dev, "data overrun interrupt\n");
428-
cf->can_id |= CAN_ERR_CRTL;
429-
cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
426+
if (skb) {
427+
cf->can_id |= CAN_ERR_CRTL;
428+
cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
429+
}
430+
430431
stats->rx_over_errors++;
431432
stats->rx_errors++;
432433
sja1000_write_cmdreg(priv, CMD_CDO); /* clear bit */
@@ -452,41 +453,46 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
452453
else
453454
state = CAN_STATE_ERROR_ACTIVE;
454455
}
455-
if (state != CAN_STATE_BUS_OFF) {
456+
if (state != CAN_STATE_BUS_OFF && skb) {
456457
cf->can_id |= CAN_ERR_CNT;
457458
cf->data[6] = txerr;
458459
cf->data[7] = rxerr;
459460
}
460461
if (isrc & IRQ_BEI) {
461462
/* bus error interrupt */
462463
priv->can.can_stats.bus_error++;
463-
stats->rx_errors++;
464464

465465
ecc = priv->read_reg(priv, SJA1000_ECC);
466+
if (skb) {
467+
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
466468

467-
cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
468-
469-
/* set error type */
470-
switch (ecc & ECC_MASK) {
471-
case ECC_BIT:
472-
cf->data[2] |= CAN_ERR_PROT_BIT;
473-
break;
474-
case ECC_FORM:
475-
cf->data[2] |= CAN_ERR_PROT_FORM;
476-
break;
477-
case ECC_STUFF:
478-
cf->data[2] |= CAN_ERR_PROT_STUFF;
479-
break;
480-
default:
481-
break;
482-
}
469+
/* set error type */
470+
switch (ecc & ECC_MASK) {
471+
case ECC_BIT:
472+
cf->data[2] |= CAN_ERR_PROT_BIT;
473+
break;
474+
case ECC_FORM:
475+
cf->data[2] |= CAN_ERR_PROT_FORM;
476+
break;
477+
case ECC_STUFF:
478+
cf->data[2] |= CAN_ERR_PROT_STUFF;
479+
break;
480+
default:
481+
break;
482+
}
483483

484-
/* set error location */
485-
cf->data[3] = ecc & ECC_SEG;
484+
/* set error location */
485+
cf->data[3] = ecc & ECC_SEG;
486+
}
486487

487488
/* Error occurred during transmission? */
488-
if ((ecc & ECC_DIR) == 0)
489-
cf->data[2] |= CAN_ERR_PROT_TX;
489+
if ((ecc & ECC_DIR) == 0) {
490+
stats->tx_errors++;
491+
if (skb)
492+
cf->data[2] |= CAN_ERR_PROT_TX;
493+
} else {
494+
stats->rx_errors++;
495+
}
490496
}
491497
if (isrc & IRQ_EPI) {
492498
/* error passive interrupt */
@@ -502,8 +508,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
502508
netdev_dbg(dev, "arbitration lost interrupt\n");
503509
alc = priv->read_reg(priv, SJA1000_ALC);
504510
priv->can.can_stats.arbitration_lost++;
505-
cf->can_id |= CAN_ERR_LOSTARB;
506-
cf->data[0] = alc & 0x1f;
511+
if (skb) {
512+
cf->can_id |= CAN_ERR_LOSTARB;
513+
cf->data[0] = alc & 0x1f;
514+
}
507515
}
508516

509517
if (state != priv->can.state) {
@@ -516,6 +524,9 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
516524
can_bus_off(dev);
517525
}
518526

527+
if (!skb)
528+
return -ENOMEM;
529+
519530
netif_rx(skb);
520531

521532
return ret;

0 commit comments

Comments
 (0)