* [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load
[not found] <20190724130322.31702-1-mkl@pengutronix.de>
@ 2019-07-24 13:03 ` Marc Kleine-Budde
[not found] ` <20190724210328.D91DF21873@mail.kernel.org>
2019-07-24 13:03 ` [PATCH 4/7] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode() Marc Kleine-Budde
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Marc Kleine-Budde @ 2019-07-24 13:03 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Nikita Yushchenko, linux-stable,
Marc Kleine-Budde
From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
We have observed rcar_canfd driver entering IRQ storm under high load,
with following scenario:
- rcar_canfd_global_interrupt() in entered due to Rx available,
- napi_schedule_prep() is called, and sets NAPIF_STATE_SCHED in state
- Rx fifo interrupts are masked,
- rcar_canfd_global_interrupt() is entered again, this time due to
error interrupt (e.g. due to overflow),
- since scheduled napi poller has not yet executed, condition for calling
napi_schedule_prep() from rcar_canfd_global_interrupt() remains true,
thus napi_schedule_prep() gets called and sets NAPIF_STATE_MISSED flag
in state,
- later, napi poller function rcar_canfd_rx_poll() gets executed, and
calls napi_complete_done(),
- due to NAPIF_STATE_MISSED flag in state, this call does not clear
NAPIF_STATE_SCHED flag from state,
- on return from napi_complete_done(), rcar_canfd_rx_poll() unmasks Rx
interrutps,
- Rx interrupt happens, rcar_canfd_global_interrupt() gets called
and calls napi_schedule_prep(),
- since NAPIF_STATE_SCHED is set in state at this time, this call
returns false,
- due to that false return, rcar_canfd_global_interrupt() returns
without masking Rx interrupt
- and this results into IRQ storm: unmasked Rx interrupt happens again
and again is misprocessed in the same way.
This patch fixes that scenario by unmasking Rx interrupts only when
napi_complete_done() returns true, which means it has cleared
NAPIF_STATE_SCHED in state.
Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver")
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/rcar/rcar_canfd.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
index 05410008aa6b..de34a4b82d4a 100644
--- a/drivers/net/can/rcar/rcar_canfd.c
+++ b/drivers/net/can/rcar/rcar_canfd.c
@@ -1508,10 +1508,11 @@ static int rcar_canfd_rx_poll(struct napi_struct *napi, int quota)
/* All packets processed */
if (num_pkts < quota) {
- napi_complete_done(napi, num_pkts);
- /* Enable Rx FIFO interrupts */
- rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
- RCANFD_RFCC_RFIE);
+ if (napi_complete_done(napi, num_pkts)) {
+ /* Enable Rx FIFO interrupts */
+ rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
+ RCANFD_RFCC_RFIE);
+ }
}
return num_pkts;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 4/7] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode()
[not found] <20190724130322.31702-1-mkl@pengutronix.de>
2019-07-24 13:03 ` [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load Marc Kleine-Budde
@ 2019-07-24 13:03 ` Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 5/7] can: flexcan: fix stop mode acknowledgment Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 6/7] can: peak_usb: fix potential double kfree_skb() Marc Kleine-Budde
3 siblings, 0 replies; 6+ messages in thread
From: Marc Kleine-Budde @ 2019-07-24 13:03 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Wen Yang, linux-stable, Marc Kleine-Budde
From: Wen Yang <wen.yang99@zte.com.cn>
The gpr_np variable is still being used in dev_dbg() after the
of_node_put() call, which may result in use-after-free.
Fixes: de3578c198c6 ("can: flexcan: add self wakeup support")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: linux-stable <stable@vger.kernel.org> # >= v5.0
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/flexcan.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index f2fe344593d5..33ce45d51e15 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1437,10 +1437,10 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
priv = netdev_priv(dev);
priv->stm.gpr = syscon_node_to_regmap(gpr_np);
- of_node_put(gpr_np);
if (IS_ERR(priv->stm.gpr)) {
dev_dbg(&pdev->dev, "could not find gpr regmap\n");
- return PTR_ERR(priv->stm.gpr);
+ ret = PTR_ERR(priv->stm.gpr);
+ goto out_put_node;
}
priv->stm.req_gpr = out_val[1];
@@ -1455,7 +1455,9 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
device_set_wakeup_capable(&pdev->dev, true);
- return 0;
+out_put_node:
+ of_node_put(gpr_np);
+ return ret;
}
static const struct of_device_id flexcan_of_match[] = {
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 5/7] can: flexcan: fix stop mode acknowledgment
[not found] <20190724130322.31702-1-mkl@pengutronix.de>
2019-07-24 13:03 ` [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 4/7] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode() Marc Kleine-Budde
@ 2019-07-24 13:03 ` Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 6/7] can: peak_usb: fix potential double kfree_skb() Marc Kleine-Budde
3 siblings, 0 replies; 6+ messages in thread
From: Marc Kleine-Budde @ 2019-07-24 13:03 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Joakim Zhang, Marc Kleine-Budde, linux-stable
From: Joakim Zhang <qiangqing.zhang@nxp.com>
To enter stop mode, the CPU should manually assert a global Stop Mode
request and check the acknowledgment asserted by FlexCAN. The CPU must
only consider the FlexCAN in stop mode when both request and
acknowledgment conditions are satisfied.
Fixes: de3578c198c6 ("can: flexcan: add self wakeup support")
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Cc: linux-stable <stable@vger.kernel.org> # >= v5.0
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/flexcan.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 33ce45d51e15..fcec8bcb53d6 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -400,9 +400,10 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable)
priv->write(reg_mcr, ®s->mcr);
}
-static inline void flexcan_enter_stop_mode(struct flexcan_priv *priv)
+static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv)
{
struct flexcan_regs __iomem *regs = priv->regs;
+ unsigned int ackval;
u32 reg_mcr;
reg_mcr = priv->read(®s->mcr);
@@ -412,20 +413,37 @@ static inline void flexcan_enter_stop_mode(struct flexcan_priv *priv)
/* enable stop request */
regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,
1 << priv->stm.req_bit, 1 << priv->stm.req_bit);
+
+ /* get stop acknowledgment */
+ if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr,
+ ackval, ackval & (1 << priv->stm.ack_bit),
+ 0, FLEXCAN_TIMEOUT_US))
+ return -ETIMEDOUT;
+
+ return 0;
}
-static inline void flexcan_exit_stop_mode(struct flexcan_priv *priv)
+static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv)
{
struct flexcan_regs __iomem *regs = priv->regs;
+ unsigned int ackval;
u32 reg_mcr;
/* remove stop request */
regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,
1 << priv->stm.req_bit, 0);
+ /* get stop acknowledgment */
+ if (regmap_read_poll_timeout(priv->stm.gpr, priv->stm.ack_gpr,
+ ackval, !(ackval & (1 << priv->stm.ack_bit)),
+ 0, FLEXCAN_TIMEOUT_US))
+ return -ETIMEDOUT;
+
reg_mcr = priv->read(®s->mcr);
reg_mcr &= ~FLEXCAN_MCR_SLF_WAK;
priv->write(reg_mcr, ®s->mcr);
+
+ return 0;
}
static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv)
@@ -1614,7 +1632,9 @@ static int __maybe_unused flexcan_suspend(struct device *device)
*/
if (device_may_wakeup(device)) {
enable_irq_wake(dev->irq);
- flexcan_enter_stop_mode(priv);
+ err = flexcan_enter_stop_mode(priv);
+ if (err)
+ return err;
} else {
err = flexcan_chip_disable(priv);
if (err)
@@ -1664,10 +1684,13 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device)
{
struct net_device *dev = dev_get_drvdata(device);
struct flexcan_priv *priv = netdev_priv(dev);
+ int err;
if (netif_running(dev) && device_may_wakeup(device)) {
flexcan_enable_wakeup_irq(priv, false);
- flexcan_exit_stop_mode(priv);
+ err = flexcan_exit_stop_mode(priv);
+ if (err)
+ return err;
}
return 0;
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 6/7] can: peak_usb: fix potential double kfree_skb()
[not found] <20190724130322.31702-1-mkl@pengutronix.de>
` (2 preceding siblings ...)
2019-07-24 13:03 ` [PATCH 5/7] can: flexcan: fix stop mode acknowledgment Marc Kleine-Budde
@ 2019-07-24 13:03 ` Marc Kleine-Budde
3 siblings, 0 replies; 6+ messages in thread
From: Marc Kleine-Budde @ 2019-07-24 13:03 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Stephane Grosjean, linux-stable,
Marc Kleine-Budde
From: Stephane Grosjean <s.grosjean@peak-system.com>
When closing the CAN device while tx skbs are inflight, echo skb could
be released twice. By calling close_candev() before unlinking all
pending tx urbs, then the internal echo_skb[] array is fully and
correctly cleared before the USB write callback and, therefore,
can_get_echo_skb() are called, for each aborted URB.
Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 458154c9b482..22b9c8e6d040 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -568,16 +568,16 @@ static int peak_usb_ndo_stop(struct net_device *netdev)
dev->state &= ~PCAN_USB_STATE_STARTED;
netif_stop_queue(netdev);
+ close_candev(netdev);
+
+ dev->can.state = CAN_STATE_STOPPED;
+
/* unlink all pending urbs and free used memory */
peak_usb_unlink_all_urbs(dev);
if (dev->adapter->dev_stop)
dev->adapter->dev_stop(dev);
- close_candev(netdev);
-
- dev->can.state = CAN_STATE_STOPPED;
-
/* can set bus off now */
if (dev->adapter->dev_set_bus) {
int err = dev->adapter->dev_set_bus(dev, 0);
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load
[not found] ` <20190724210328.D91DF21873@mail.kernel.org>
@ 2019-07-25 13:29 ` Nikita Yushchenko
2019-07-25 13:41 ` Marc Kleine-Budde
0 siblings, 1 reply; 6+ messages in thread
From: Nikita Yushchenko @ 2019-07-25 13:29 UTC (permalink / raw)
To: Sasha Levin, Marc Kleine-Budde, netdev; +Cc: davem, linux-can, linux-stable
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
I don't know.
Maintainer did not respond, nor to original send nor to resend.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load
2019-07-25 13:29 ` Nikita Yushchenko
@ 2019-07-25 13:41 ` Marc Kleine-Budde
0 siblings, 0 replies; 6+ messages in thread
From: Marc Kleine-Budde @ 2019-07-25 13:41 UTC (permalink / raw)
To: Nikita Yushchenko, Sasha Levin, netdev; +Cc: davem, linux-can, linux-stable
[-- Attachment #1.1: Type: text/plain, Size: 607 bytes --]
On 7/25/19 3:29 PM, Nikita Yushchenko wrote:
>> NOTE: The patch will not be queued to stable trees until it is upstream.
>>
>> How should we proceed with this patch?
>
> I don't know.
> Maintainer did not respond, nor to original send nor to resend.
You can backport this patch to v4.9.186 and send it to Sasha
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-07-25 13:41 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20190724130322.31702-1-mkl@pengutronix.de>
2019-07-24 13:03 ` [PATCH 2/7] can: rcar_canfd: fix possible IRQ storm on high load Marc Kleine-Budde
[not found] ` <20190724210328.D91DF21873@mail.kernel.org>
2019-07-25 13:29 ` Nikita Yushchenko
2019-07-25 13:41 ` Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 4/7] can: flexcan: fix an use-after-free in flexcan_setup_stop_mode() Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 5/7] can: flexcan: fix stop mode acknowledgment Marc Kleine-Budde
2019-07-24 13:03 ` [PATCH 6/7] can: peak_usb: fix potential double kfree_skb() Marc Kleine-Budde
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).