kernel/drivers/net/can, branch linux-4.1.y

can: cc770: Fix use after free in cc770_tx_interrupt()

2018-05-23T01:33:53Z

[ Upstream commit 9ffd7503944ec7c0ef41c3245d1306c221aef2be ] This fixes use after free introduced by the last cc770 patch. Signed-off-by: Andri Yngvason Fixes: 746201235b3f ("can: cc770: Fix queue stall & dropped RTR reply") Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: cc770: Fix queue stall & dropped RTR reply

2018-05-23T01:33:53Z

[ Upstream commit 746201235b3f876792099079f4c6fea941d76183 ] While waiting for the TX object to send an RTR, an external message with a matching id can overwrite the TX data. In this case we must call the rx routine and then try transmitting the message that was overwritten again. The queue was being stalled because the RX event did not generate an interrupt to wake up the queue again and the TX event did not happen because the TXRQST flag is reset by the chip when new data is received. According to the CC770 datasheet the id of a message object should not be changed while the MSGVAL bit is set. This has been fixed by resetting the MSGVAL bit before modifying the object in the transmit function and setting it after. It is not enough to set & reset CPUUPD. It is important to keep the MSGVAL bit reset while the message object is being modified. Otherwise, during RTR transmission, a frame with matching id could trigger an rx-interrupt, which would cause a race condition between the interrupt routine and the transmit function. Signed-off-by: Andri Yngvason Tested-by: Richard Weinberger Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack

2018-05-23T01:33:53Z

[ Upstream commit f4353daf4905c0099fd25fa742e2ffd4a4bab26a ] This has been reported to cause stalls on rt-linux. Suggested-by: Richard Weinberger Tested-by: Richard Weinberger Signed-off-by: Andri Yngvason Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: peak: fix potential bug in packet fragmentation

2018-03-01T03:09:39Z

[ Upstream commit d8a243af1a68395e07ac85384a2740d4134c67f4 ] In some rare conditions when running one PEAK USB-FD interface over a non high-speed USB controller, one useless USB fragment might be sent. This patch fixes the way a USB command is fragmented when its length is greater than 64 bytes and when the underlying USB controller is not a high-speed one. Signed-off-by: Stephane Grosjean Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: gs_usb: fix return value of the "set_bittiming" callback

2018-03-01T00:32:21Z

[ Upstream commit d5b42e6607661b198d8b26a0c30969605b1bf5c7 ] The "set_bittiming" callback treats a positive return value as error! For that reason "can_changelink()" will quit silently after setting the bittiming values without processing ctrlmode, restart-ms, etc. Signed-off-by: Wolfgang Grandegger Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: usb_8dev: cancel urb on -EPIPE and -EPROTO

2018-01-17T17:55:21Z

[ Upstream commit 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce ] In mcba_usb, we have observed that when you unplug the device, the driver will endlessly resubmit failing URBs, which can cause CPU stalls. This issue is fixed in mcba_usb by catching the codes seen on device disconnect (-EPIPE and -EPROTO). This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it in the same way. Signed-off-by: Martin Kelly Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: esd_usb2: cancel urb on -EPIPE and -EPROTO

2018-01-17T17:55:21Z

[ Upstream commit 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 ] In mcba_usb, we have observed that when you unplug the device, the driver will endlessly resubmit failing URBs, which can cause CPU stalls. This issue is fixed in mcba_usb by catching the codes seen on device disconnect (-EPIPE and -EPROTO). This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it in the same way. Signed-off-by: Martin Kelly Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: ems_usb: cancel urb on -EPIPE and -EPROTO

2018-01-17T17:55:21Z

[ Upstream commit bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 ] In mcba_usb, we have observed that when you unplug the device, the driver will endlessly resubmit failing URBs, which can cause CPU stalls. This issue is fixed in mcba_usb by catching the codes seen on device disconnect (-EPIPE and -EPROTO). This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it in the same way. Signed-off-by: Martin Kelly Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: kvaser_usb: cancel urb on -EPIPE and -EPROTO

2018-01-17T17:55:21Z

[ Upstream commit 6aa8d5945502baf4687d80de59b7ac865e9e666b ] In mcba_usb, we have observed that when you unplug the device, the driver will endlessly resubmit failing URBs, which can cause CPU stalls. This issue is fixed in mcba_usb by catching the codes seen on device disconnect (-EPIPE and -EPROTO). This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it in the same way. Signed-off-by: Martin Kelly Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin

can: kvaser_usb: ratelimit errors if incomplete messages are received

2018-01-17T17:55:21Z

[ Upstream commit 8bd13bd522ff7dfa0eb371921aeb417155f7a3be ] Avoid flooding the kernel log with "Formate error", if incomplete message are received. Signed-off-by: Jimmy Assarsson Cc: linux-stable Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin