From 825e5601c14278cf065a0f28e99a73a2745f2549 Mon Sep 17 00:00:00 2001 From: Appana Durga Kedareswara rao Date: Thu, 21 Nov 2019 14:09:24 +0530 Subject: MAINTAINERS: add fragment for xilinx CAN driver Added entry for xilinx CAN driver. Signed-off-by: Appana Durga Kedareswara rao Signed-off-by: Marc Kleine-Budde --- MAINTAINERS | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 8608724835dd..d700e27ebf41 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -18103,6 +18103,14 @@ M: Radhey Shyam Pandey S: Maintained F: drivers/net/ethernet/xilinx/xilinx_axienet* +XILINX CAN DRIVER +M: Appana Durga Kedareswara rao +R: Naga Sureshkumar Relli +L: linux-can@vger.kernel.org +S: Maintained +F: Documentation/devicetree/bindings/net/can/xilinx_can.txt +F: drivers/net/can/xilinx_can.c + XILINX UARTLITE SERIAL DRIVER M: Peter Korsgaard L: linux-serial@vger.kernel.org -- cgit v1.2.3-73-gaa49b From 8c2a58568d6d952f7c7f1dac125b33dc8414627b Mon Sep 17 00:00:00 2001 From: Sriram Dash Date: Tue, 3 Dec 2019 09:59:09 +0530 Subject: MAINTAINERS: add myself as maintainer of MCAN MMIO device driver Since we are actively working on MMIO MCAN device driver, as discussed with Marc, I am adding myself as a maintainer. Signed-off-by: Sriram Dash Signed-off-by: Marc Kleine-Budde --- MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index d700e27ebf41..ecc354f4b692 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -10094,6 +10094,15 @@ W: https://linuxtv.org S: Maintained F: drivers/media/radio/radio-maxiradio* +MCAN MMIO DEVICE DRIVER +M: Sriram Dash +L: linux-can@vger.kernel.org +S: Maintained +F: Documentation/devicetree/bindings/net/can/m_can.txt +F: drivers/net/can/m_can/m_can.c +F: drivers/net/can/m_can/m_can.h +F: drivers/net/can/m_can/m_can_platform.c + MCP4018 AND MCP4531 MICROCHIP DIGITAL POTENTIOMETER DRIVERS M: Peter Rosin L: linux-iio@vger.kernel.org -- cgit v1.2.3-73-gaa49b From 9ebd796e24008f33f06ebea5a5e6aceb68b51794 Mon Sep 17 00:00:00 2001 From: Jouni Hogander Date: Wed, 27 Nov 2019 08:40:26 +0200 Subject: can: slcan: Fix use-after-free Read in slcan_open Slcan_open doesn't clean-up device which registration failed from the slcan_devs device list. On next open this list is iterated and freed device is accessed. Fix this by calling slc_free_netdev in error path. Driver/net/can/slcan.c is derived from slip.c. Use-after-free error was identified in slip_open by syzboz. Same bug is in slcan.c. Here is the trace from the Syzbot slip report: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 sl_sync drivers/net/slip/slip.c:725 [inline] slip_open+0xecd/0x11b7 drivers/net/slip/slip.c:801 tty_ldisc_open.isra.0+0xa3/0x110 drivers/tty/tty_ldisc.c:469 tty_set_ldisc+0x30e/0x6b0 drivers/tty/tty_ldisc.c:596 tiocsetd drivers/tty/tty_io.c:2334 [inline] tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2594 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: ed50e1600b44 ("slcan: Fix memory leak in error path") Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: David Miller Cc: Oliver Hartkopp Cc: Lukas Bulwahn Signed-off-by: Jouni Hogander Cc: linux-stable # >= v5.4 Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde --- drivers/net/can/slcan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index 0a9f42e5fedf..2e57122f02fb 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -617,6 +617,7 @@ err_free_chan: sl->tty = NULL; tty->disc_data = NULL; clear_bit(SLF_INUSE, &sl->flags); + slc_free_netdev(sl->dev); free_netdev(sl->dev); err_exit: -- cgit v1.2.3-73-gaa49b From 870db5d1015c8bd63e93b579e857223c96249ff7 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 28 Nov 2019 19:26:03 +0100 Subject: can: ucan: fix non-atomic allocation in completion handler USB completion handlers are called in atomic context and must specifically not allocate memory using GFP_KERNEL. Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Cc: stable # 4.19 Cc: Jakob Unterwurzacher Cc: Martin Elshuber Cc: Philipp Tomsich Signed-off-by: Johan Hovold Signed-off-by: Marc Kleine-Budde --- drivers/net/can/usb/ucan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c index 04aac3bb54ef..81e942f713e6 100644 --- a/drivers/net/can/usb/ucan.c +++ b/drivers/net/can/usb/ucan.c @@ -792,7 +792,7 @@ resubmit: up); usb_anchor_urb(urb, &up->rx_urbs); - ret = usb_submit_urb(urb, GFP_KERNEL); + ret = usb_submit_urb(urb, GFP_ATOMIC); if (ret < 0) { netdev_err(up->netdev, -- cgit v1.2.3-73-gaa49b From b848238d86aacc3df69c76a20ab2aa85db8775e1 Mon Sep 17 00:00:00 2001 From: Venkatesh Yadav Abbarapu Date: Mon, 2 Dec 2019 18:32:10 +0530 Subject: can: xilinx_can: skip error message on deferred probe When the CAN bus clock is provided from the clock wizard, clock wizard driver may not be available when can driver probes resulting to the error message "bus clock not found error". As this error message is not very useful to the end user, skip printing in the case of deferred probe. Signed-off-by: Venkatesh Yadav Abbarapu Signed-off-by: Srinivas Neeli Signed-off-by: Michal Simek Reviewed-by: Appana Durga Kedareswara Rao Signed-off-by: Marc Kleine-Budde --- drivers/net/can/xilinx_can.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c index 4a96e2dd7d77..c5f05b994435 100644 --- a/drivers/net/can/xilinx_can.c +++ b/drivers/net/can/xilinx_can.c @@ -1772,7 +1772,8 @@ static int xcan_probe(struct platform_device *pdev) priv->bus_clk = devm_clk_get(&pdev->dev, devtype->bus_clk_name); if (IS_ERR(priv->bus_clk)) { - dev_err(&pdev->dev, "bus clock not found\n"); + if (PTR_ERR(priv->bus_clk) != -EPROBE_DEFER) + dev_err(&pdev->dev, "bus clock not found\n"); ret = PTR_ERR(priv->bus_clk); goto err_free; } -- cgit v1.2.3-73-gaa49b From 3d3c817c3a409ba51ad6e44dd8fde4cfc07c93fe Mon Sep 17 00:00:00 2001 From: Srinivas Neeli Date: Mon, 2 Dec 2019 18:32:11 +0530 Subject: can: xilinx_can: Fix usage of skb memory As per linux can framework, driver not allowed to touch the skb memory after can_put_echo_skb() call. This patch fixes the same. https://www.spinics.net/lists/linux-can/msg02199.html Signed-off-by: Srinivas Neeli Reviewed-by: Appana Durga Kedareswara Rao Signed-off-by: Marc Kleine-Budde --- drivers/net/can/xilinx_can.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c index c5f05b994435..464af939cd8a 100644 --- a/drivers/net/can/xilinx_can.c +++ b/drivers/net/can/xilinx_can.c @@ -542,16 +542,17 @@ static int xcan_do_set_mode(struct net_device *ndev, enum can_mode mode) /** * xcan_write_frame - Write a frame to HW - * @priv: Driver private data structure + * @ndev: Pointer to net_device structure * @skb: sk_buff pointer that contains data to be Txed * @frame_offset: Register offset to write the frame to */ -static void xcan_write_frame(struct xcan_priv *priv, struct sk_buff *skb, +static void xcan_write_frame(struct net_device *ndev, struct sk_buff *skb, int frame_offset) { u32 id, dlc, data[2] = {0, 0}; struct canfd_frame *cf = (struct canfd_frame *)skb->data; u32 ramoff, dwindex = 0, i; + struct xcan_priv *priv = netdev_priv(ndev); /* Watch carefully on the bit sequence */ if (cf->can_id & CAN_EFF_FLAG) { @@ -587,6 +588,14 @@ static void xcan_write_frame(struct xcan_priv *priv, struct sk_buff *skb, dlc |= XCAN_DLCR_EDL_MASK; } + if (!(priv->devtype.flags & XCAN_FLAG_TX_MAILBOXES) && + (priv->devtype.flags & XCAN_FLAG_TXFEMP)) + can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max); + else + can_put_echo_skb(skb, ndev, 0); + + priv->tx_head++; + priv->write_reg(priv, XCAN_FRAME_ID_OFFSET(frame_offset), id); /* If the CAN frame is RTR frame this write triggers transmission * (not on CAN FD) @@ -638,13 +647,9 @@ static int xcan_start_xmit_fifo(struct sk_buff *skb, struct net_device *ndev) XCAN_SR_TXFLL_MASK)) return -ENOSPC; - can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max); - spin_lock_irqsave(&priv->tx_lock, flags); - priv->tx_head++; - - xcan_write_frame(priv, skb, XCAN_TXFIFO_OFFSET); + xcan_write_frame(ndev, skb, XCAN_TXFIFO_OFFSET); /* Clear TX-FIFO-empty interrupt for xcan_tx_interrupt() */ if (priv->tx_max > 1) @@ -675,13 +680,9 @@ static int xcan_start_xmit_mailbox(struct sk_buff *skb, struct net_device *ndev) BIT(XCAN_TX_MAILBOX_IDX))) return -ENOSPC; - can_put_echo_skb(skb, ndev, 0); - spin_lock_irqsave(&priv->tx_lock, flags); - priv->tx_head++; - - xcan_write_frame(priv, skb, + xcan_write_frame(ndev, skb, XCAN_TXMSG_FRAME_OFFSET(XCAN_TX_MAILBOX_IDX)); /* Mark buffer as ready for transmit */ -- cgit v1.2.3-73-gaa49b