Commit 16d93558 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'linux-can-fixes-for-6.17-20250923' of... 

Merge tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2025-09-23

The 1st patch is by Chen Yufeng and fixes a potential NULL pointer
deref in the hi311x driver.

Duy Nguyen contributes a patch for the rcar_canfd driver to fix the
controller mode setting.

The next 4 patches are by Vincent Mailhol and populate the
ndo_change_mtu(( callback in the etas_es58x, hi311x, sun4i_can and
mcba_usb driver to prevent buffer overflows.

Stéphane Grosjean's patch for the peak_usb driver fixes a
shift-out-of-bounds issue.

* tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  can: rcar_canfd: Fix controller mode setting
  can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
====================

Link: https://patch.msgid.link/20250923073427.493034-1-mkl@pengutronix.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 3d3aa947 c443be70

drivers/net/can/rcar/rcar_canfd.c

+4 −3
Original line number Diff line number Diff line
@@ -823,9 +823,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) 
	/* Reset Global error flags */

	rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);



	/* Set the controller into appropriate mode */

	rcar_canfd_set_mode(gpriv);



	/* Transition all Channels to reset mode */

	for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {

		rcar_canfd_clear_bit(gpriv->base,
@@ -844,6 +841,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) 
			return err;

		}

	}



	/* Set the controller into appropriate mode */

	rcar_canfd_set_mode(gpriv);



	return 0;

}

drivers/net/can/spi/hi311x.c

+18 −16
Original line number Diff line number Diff line
@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) 


	priv->force_quit = 1;

	free_irq(spi->irq, priv);

	destroy_workqueue(priv->wq);

	priv->wq = NULL;



	mutex_lock(&priv->hi3110_lock);
@@ -770,34 +768,23 @@ static int hi3110_open(struct net_device *net) 
		goto out_close;

	}



	priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,

				   0);

	if (!priv->wq) {

		ret = -ENOMEM;

		goto out_free_irq;

	}

	INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);

	INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);



	ret = hi3110_hw_reset(spi);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	ret = hi3110_setup(net);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	ret = hi3110_set_normal_mode(spi);

	if (ret)

		goto out_free_wq;

		goto out_free_irq;



	netif_wake_queue(net);

	mutex_unlock(&priv->hi3110_lock);



	return 0;



 out_free_wq:

	destroy_workqueue(priv->wq);

 out_free_irq:

	free_irq(spi->irq, priv);

	hi3110_hw_sleep(spi);
@@ -812,6 +799,7 @@ static const struct net_device_ops hi3110_netdev_ops = { 
	.ndo_open = hi3110_open,

	.ndo_stop = hi3110_stop,

	.ndo_start_xmit = hi3110_hard_start_xmit,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops hi3110_ethtool_ops = {
@@ -908,6 +896,15 @@ static int hi3110_can_probe(struct spi_device *spi) 
	if (ret)

		goto out_clk;



	priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,

				   0);

	if (!priv->wq) {

		ret = -ENOMEM;

		goto out_clk;

	}

	INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);

	INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);



	priv->spi = spi;

	mutex_init(&priv->hi3110_lock);
@@ -943,6 +940,8 @@ static int hi3110_can_probe(struct spi_device *spi) 
	return 0;



 error_probe:

	destroy_workqueue(priv->wq);

	priv->wq = NULL;

	hi3110_power_enable(priv->power, 0);



 out_clk:
@@ -963,6 +962,9 @@ static void hi3110_can_remove(struct spi_device *spi) 


	hi3110_power_enable(priv->power, 0);



	destroy_workqueue(priv->wq);

	priv->wq = NULL;



	clk_disable_unprepare(priv->clk);



	free_candev(net);

drivers/net/can/sun4i_can.c

+1 −0
Original line number Diff line number Diff line
@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = { 
	.ndo_open = sun4ican_open,

	.ndo_stop = sun4ican_close,

	.ndo_start_xmit = sun4ican_start_xmit,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops sun4ican_ethtool_ops = {

drivers/net/can/usb/etas_es58x/es58x_core.c

+2 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
 *

 * Copyright (c) 2019 Robert Bosch Engineering and Business Solutions. All rights reserved.

 * Copyright (c) 2020 ETAS K.K.. All rights reserved.

 * Copyright (c) 2020-2022 Vincent Mailhol <mailhol.vincent@wanadoo.fr>

 * Copyright (c) 2020-2025 Vincent Mailhol <mailhol@kernel.org>

 */



#include <linux/unaligned.h>
@@ -1977,6 +1977,7 @@ static const struct net_device_ops es58x_netdev_ops = { 
	.ndo_stop = es58x_stop,

	.ndo_start_xmit = es58x_start_xmit,

	.ndo_eth_ioctl = can_eth_ioctl_hwts,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops es58x_ethtool_ops = {

drivers/net/can/usb/mcba_usb.c

+1 −0
Original line number Diff line number Diff line
@@ -761,6 +761,7 @@ static const struct net_device_ops mcba_netdev_ops = { 
	.ndo_open = mcba_usb_open,

	.ndo_stop = mcba_usb_close,

	.ndo_start_xmit = mcba_usb_start_xmit,

	.ndo_change_mtu = can_change_mtu,

};



static const struct ethtool_ops mcba_ethtool_ops = {