linux-toradex.git/drivers/net/can, branch v3.12.25

can: peak_pci: prevent use after free at netdev removal

2014-07-02T10:06:01+00:00

commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream.

As remarked by Christopher R. Baker in his post at

http://marc.info/?l=linux-can&m=139707295706465&w=2

there's a possibility for an use after free condition at device removal.

This simplified patch introduces an additional variable to prevent the issue.
Thanks for catching this.

Reported-by: Christopher R. Baker 
Signed-off-by: Stephane Grosjean 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: flexcan: flexcan_remove(): add missing netif_napi_del()

2014-03-24T08:45:02+00:00

commit d96e43e8fce28cf97df576a07af9d65657a41a6f upstream.

This patch adds the missing netif_napi_del() to the flexcan_remove() function.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: flexcan: factor out transceiver {en,dis}able into seperate functions

2014-03-24T08:45:02+00:00

commit f003698e23f6f56a791774f14d0ac35d04872490 upstream.

This patch moves the transceiver enable and disable into seperate functions,
where the NULL pointer check is hidden.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: flexcan: fix transition from and to low power mode in chip_{en,dis}able

2014-03-24T08:45:01+00:00

commit 9b00b300e7bce032c467c36ca47fe2a776887fc2 upstream.

In flexcan_chip_enable() and flexcan_chip_disable() fixed delays are used.
Experiments have shown that the transition from and to low power mode may take
several microseconds.

This patch adds a while loop which polls the Low Power Mode ACK bit (LPM_ACK)
that indicates a successfull mode change. If the function runs into a timeout a
error value is returned.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: flexcan: flexcan_open(): fix error path if flexcan_chip_start() fails

2014-03-24T08:45:01+00:00

commit 7e9e148af01ef388efb6e2490805970be4622792 upstream.

If flexcan_chip_start() in flexcan_open() fails, the interrupt is not freed,
this patch adds the missing cleanup.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: flexcan: fix shutdown: first disable chip, then all interrupts

2014-03-24T08:45:01+00:00

commit 5be93bdda64e85450598c6e97f79fb8f6acf30e0 upstream.

When shutting down the CAN interface (ifconfig canX down) during high CAN bus
loads, the CAN core might hang and freeze the whole CPU.

This patch fixes the shutdown sequence by first disabling the CAN core then
disabling all interrupts.

Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: kvaser_usb: check number of channels returned by HW

2014-03-05T16:13:48+00:00

commit 862474f8b46f6c1e600d4934e40ba40646c696ec upstream.

It is needed to check the number of channels returned by the HW because it
cannot be greater than MAX_NET_DEVICES otherwise it will crash.

Signed-off-by: Olivier Sobrie 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Jiri Slaby

can: add destructor for self generated skbs

2014-02-26T09:22:51+00:00

[ Upstream commit 0ae89beb283a0db5980d1d4781c7d7be2f2810d6 ]

Self generated skbuffs in net/can/bcm.c are setting a skb->sk reference but
no explicit destructor which is enforced since Linux 3.11 with commit
376c7311bdb6 (net: add a temporary sanity check in skb_orphan()).

This patch adds some helper functions to make sure that a destructor is
properly defined when a sock reference is assigned to a CAN related skb.
To create an unshared skb owned by the original sock a common helper function
has been introduced to replace open coded functions to create CAN echo skbs.

Signed-off-by: Oliver Hartkopp 
Tested-by: Andre Naujoks 
Reviewed-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Jiri Slaby

can: peak_usb: fix mem leak in pcan_usb_pro_init()

2014-01-09T20:25:08+00:00

commit 20fb4eb96fb0350d28fc4d7cbfd5506711079592 upstream.

This patch fixes a memory leak in pcan_usb_pro_init(). In patch

    f14e224 net: can: peak_usb: Do not do dma on the stack

the struct pcan_usb_pro_fwinfo *fi and struct pcan_usb_pro_blinfo *bi were
converted from stack to dynamic allocation va kmalloc(). However the
corresponding kfree() was not introduced.

This patch adds the missing kfree().

Reported-by: Stephane Grosjean 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman

can: c_can: don't call pm_runtime_get_sync() from interrupt context

2013-12-12T06:37:53+00:00

commit e35d46adc49b469fd92bdb64fea8af93640e6651 upstream.

The c_can driver contians a callpath (c_can_poll -> c_can_state_change ->
c_can_get_berr_counter) which may call pm_runtime_get_sync() from the IRQ
handler, which is not allowed and results in "BUG: scheduling while atomic".

This problem is fixed by introducing __c_can_get_berr_counter, which will not
call pm_runtime_get_sync().

Reported-by: Andrew Glen 
Tested-by: Andrew Glen 
Signed-off-by: Andrew Glen 
Signed-off-by: Marc Kleine-Budde 
Signed-off-by: Greg Kroah-Hartman