Commit c649e997 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'linux-can-fixes-for-7.0-20260302' of... 

Merge tag 'linux-can-fixes-for-7.0-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2026-03-02

The first 2 patches are by Oliver Hartkopp. The first fixes the
locking for CAN Broadcast Manager op runtime updates, the second fixes
the packet statisctics for the CAN dummy driver.

Alban Bedel's patch fixes a potential problem in the error path of the
mcp251x's ndo_open callback.

A patch by Ziyi Guo add USB endpoint type validation to the esd_usb
driver.

The next 6 patches are by Greg Kroah-Hartman and fix URB data parsing
for the ems_usb and ucan driver, fix URB anchoring in the etas_es58x,
and in the f81604 driver fix URB data parsing, add URB error handling
and fix URB anchoring.

A patch by me targets the gs_usb driver and fixes interoperability
with the CANable-2.5 firmware by always configuring the bit rate
before starting the device.

The last patch is by Frank Li and fixes a CHECK_DTBS warning for the
nxp,sja1000 dt-binding.

* tag 'linux-can-fixes-for-7.0-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  dt-bindings: net: can: nxp,sja1000: add reference to mc-peripheral-props.yaml
  can: gs_usb: gs_can_open(): always configure bitrates before starting device
  can: usb: f81604: correctly anchor the urb in the read bulk callback
  can: usb: f81604: handle bulk write errors properly
  can: usb: f81604: handle short interrupt urb messages properly
  can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
  can: ucan: Fix infinite loop from zero-length messages
  can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
  can: esd_usb: add endpoint type validation
  can: mcp251x: fix deadlock in error path of mcp251x_open
  can: dummy_can: dummy_can_init(): fix packet statistics
  can: bcm: fix locking for bcm_op runtime updates
====================

Link: https://patch.msgid.link/20260302152755.1700177-1-mkl@pengutronix.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 18b43bec 7e1e6d68

Documentation/devicetree/bindings/net/can/nxp,sja1000.yaml

+1 −0
Original line number Diff line number Diff line
@@ -87,6 +87,7 @@ required: 


allOf:

  - $ref: can-controller.yaml#

  - $ref: /schemas/memory-controllers/mc-peripheral-props.yaml

  - if:

      properties:

        compatible:

drivers/net/can/dummy_can.c

+1 −0
Original line number Diff line number Diff line
@@ -241,6 +241,7 @@ static int __init dummy_can_init(void) 


	dev->netdev_ops = &dummy_can_netdev_ops;

	dev->ethtool_ops = &dummy_can_ethtool_ops;

	dev->flags |= IFF_ECHO; /* enable echo handling */

	priv = netdev_priv(dev);

	priv->can.bittiming_const = &dummy_can_bittiming_const;

	priv->can.bitrate_max = 20 * MEGA /* BPS */;

drivers/net/can/spi/mcp251x.c

+14 −1
Original line number Diff line number Diff line
@@ -1214,6 +1214,7 @@ static int mcp251x_open(struct net_device *net) 
{

	struct mcp251x_priv *priv = netdev_priv(net);

	struct spi_device *spi = priv->spi;

	bool release_irq = false;

	unsigned long flags = 0;

	int ret;
@@ -1257,12 +1258,24 @@ static int mcp251x_open(struct net_device *net) 
	return 0;



out_free_irq:

	free_irq(spi->irq, priv);

	/* The IRQ handler might be running, and if so it will be waiting

	 * for the lock. But free_irq() must wait for the handler to finish

	 * so calling it here would deadlock.

	 *

	 * Setting priv->force_quit will let the handler exit right away

	 * without any access to the hardware. This make it safe to call

	 * free_irq() after the lock is released.

	 */

	priv->force_quit = 1;

	release_irq = true;



	mcp251x_hw_sleep(spi);

out_close:

	mcp251x_power_enable(priv->transceiver, 0);

	close_candev(net);

	mutex_unlock(&priv->mcp_lock);

	if (release_irq)

		free_irq(spi->irq, priv);

	return ret;

}

drivers/net/can/usb/ems_usb.c

+6 −1
Original line number Diff line number Diff line
@@ -445,6 +445,11 @@ static void ems_usb_read_bulk_callback(struct urb *urb) 
		start = CPC_HEADER_SIZE;



		while (msg_count) {

			if (start + CPC_MSG_HEADER_LEN > urb->actual_length) {

				netdev_err(netdev, "format error\n");

				break;

			}



			msg = (struct ems_cpc_msg *)&ibuf[start];



			switch (msg->type) {
@@ -474,7 +479,7 @@ static void ems_usb_read_bulk_callback(struct urb *urb) 
			start += CPC_MSG_HEADER_LEN + msg->length;

			msg_count--;



			if (start > urb->transfer_buffer_length) {

			if (start > urb->actual_length) {

				netdev_err(netdev, "format error\n");

				break;

			}

drivers/net/can/usb/esd_usb.c

+17 −13
Original line number Diff line number Diff line
@@ -272,6 +272,9 @@ struct esd_usb { 


	struct usb_anchor rx_submitted;



	unsigned int rx_pipe;

	unsigned int tx_pipe;



	int net_count;

	u32 version;

	int rxinitdone;
@@ -537,7 +540,7 @@ static void esd_usb_read_bulk_callback(struct urb *urb) 
	}



resubmit_urb:

	usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),

	usb_fill_bulk_urb(urb, dev->udev, dev->rx_pipe,

			  urb->transfer_buffer, ESD_USB_RX_BUFFER_SIZE,

			  esd_usb_read_bulk_callback, dev);
@@ -626,9 +629,7 @@ static int esd_usb_send_msg(struct esd_usb *dev, union esd_usb_msg *msg) 
{

	int actual_length;



	return usb_bulk_msg(dev->udev,

			    usb_sndbulkpipe(dev->udev, 2),

			    msg,

	return usb_bulk_msg(dev->udev, dev->tx_pipe, msg,

			    msg->hdr.len * sizeof(u32), /* convert to # of bytes */

			    &actual_length,

			    1000);
@@ -639,12 +640,8 @@ static int esd_usb_wait_msg(struct esd_usb *dev, 
{

	int actual_length;



	return usb_bulk_msg(dev->udev,

			    usb_rcvbulkpipe(dev->udev, 1),

			    msg,

			    sizeof(*msg),

			    &actual_length,

			    1000);

	return usb_bulk_msg(dev->udev, dev->rx_pipe, msg,

			    sizeof(*msg), &actual_length, 1000);

}



static int esd_usb_setup_rx_urbs(struct esd_usb *dev)
@@ -677,8 +674,7 @@ static int esd_usb_setup_rx_urbs(struct esd_usb *dev) 


		urb->transfer_dma = buf_dma;



		usb_fill_bulk_urb(urb, dev->udev,

				  usb_rcvbulkpipe(dev->udev, 1),

		usb_fill_bulk_urb(urb, dev->udev, dev->rx_pipe,

				  buf, ESD_USB_RX_BUFFER_SIZE,

				  esd_usb_read_bulk_callback, dev);

		urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -903,7 +899,7 @@ static netdev_tx_t esd_usb_start_xmit(struct sk_buff *skb, 
	/* hnd must not be 0 - MSB is stripped in txdone handling */

	msg->tx.hnd = BIT(31) | i; /* returned in TX done message */



	usb_fill_bulk_urb(urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), buf,

	usb_fill_bulk_urb(urb, dev->udev, dev->tx_pipe, buf,

			  msg->hdr.len * sizeof(u32), /* convert to # of bytes */

			  esd_usb_write_bulk_callback, context);
@@ -1298,10 +1294,16 @@ static int esd_usb_probe_one_net(struct usb_interface *intf, int index) 
static int esd_usb_probe(struct usb_interface *intf,

			 const struct usb_device_id *id)

{

	struct usb_endpoint_descriptor *ep_in, *ep_out;

	struct esd_usb *dev;

	union esd_usb_msg *msg;

	int i, err;



	err = usb_find_common_endpoints(intf->cur_altsetting, &ep_in, &ep_out,

					NULL, NULL);

	if (err)

		return err;



	dev = kzalloc_obj(*dev);

	if (!dev) {

		err = -ENOMEM;
@@ -1309,6 +1311,8 @@ static int esd_usb_probe(struct usb_interface *intf, 
	}



	dev->udev = interface_to_usbdev(intf);

	dev->rx_pipe = usb_rcvbulkpipe(dev->udev, ep_in->bEndpointAddress);

	dev->tx_pipe = usb_sndbulkpipe(dev->udev, ep_out->bEndpointAddress);



	init_usb_anchor(&dev->rx_submitted);