From nobody Sat Apr 11 22:49:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3F4BC19F2B for ; Thu, 4 Aug 2022 08:15:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239316AbiHDIPV (ORCPT ); Thu, 4 Aug 2022 04:15:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233114AbiHDIPT (ORCPT ); Thu, 4 Aug 2022 04:15:19 -0400 Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BCB27266B for ; Thu, 4 Aug 2022 01:15:17 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id q30so19885091wra.11 for ; Thu, 04 Aug 2022 01:15:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ororatech.com; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc; bh=u0fPxWrfHBCAK7CNXAq0lMMiBJFpcqgKyrM33HYWfD0=; b=H5zNallHCpcL7sb5swZAjzXZw+V6YuNIbp89IVNGRlgT4nRgYWMFgVahqaE0rqvM// 0N929iUQFhKUM0RMw5l/+FAo40iWhAnEtIOTS4QredVKptpHM7CTgqhG41CNoQfDdjE/ BoentPZMZNJxIS5H2nmrZN8YmHKwJzqtHOMc/V9lC/mgqdYek8O8Exd182pD7oF36iXB 3MXhc6VzCh0XQq6uSs7BpfO/uzI8T+frMWRtWZgr7oU4eiVBCUxT0s6cLlRmsZiC0zKy AKrosg1hUuAoAn/jvYhE1OuENnPDGqYRluuPKiaODAdT2aGZqC3HBl0y/YAr0+hiyIhH lALQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=u0fPxWrfHBCAK7CNXAq0lMMiBJFpcqgKyrM33HYWfD0=; b=fVva8ehOBXU1ppCh4YoQ7twMIkwa8RpllhgrNeqHoaq58V+gJyin93nSrzPZsX5xdB EzeosdxkXDe/MLrm431eeGu7FPCmt/2yHpfJKOGWpgLw9tXzjg7qzQqwSEh4Z7vheU1h /VzyKmQRRb7hM/KJ4Zqy3emdswXH/n7wyM0IY3Vtn5oCRo8nXHJDkki20vJth6dtfjMt xk8acVIh5yabHS2qjrPpvxwzuT2XneTvdsTsIE4kNOy4CSjG+DjJm0SGCgjH9iOIwi/e RcOhFq+32aDtWT21/y0c/ZiuNWifC0t72j3naKPfWN/MmjXxguAnoakXkzTfibeKWzsM hiDQ== X-Gm-Message-State: ACgBeo33anQQtni0YIVIaXjSc9jWY/0OmnFERRuUwmOLLSwiRbYBUk5p UlT8ZRjJioFylMtsDbcLqN7Msg== X-Google-Smtp-Source: AA6agR4Wti/eqOETZ1+yhhNM+qHHe4drEgM8/ZqEeyEiE0q/YFAeeKJlgMGFAKhM1UOdP5E+ZKxDuw== X-Received: by 2002:a5d:63cb:0:b0:21e:b81d:8b0d with SMTP id c11-20020a5d63cb000000b0021eb81d8b0dmr568865wrw.526.1659600916294; Thu, 04 Aug 2022 01:15:16 -0700 (PDT) Received: from toolbox.dsn.orora.tech (host-88-217-137-115.customer.m-online.net. [88.217.137.115]) by smtp.googlemail.com with ESMTPSA id e39-20020a5d5967000000b002205cbc1c74sm332505wri.101.2022.08.04.01.15.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Aug 2022 01:15:15 -0700 (PDT) From: =?UTF-8?q?Sebastian=20W=C3=BCrl?= To: sebastian.wuerl@ororatech.com Cc: Wolfgang Grandegger , Marc Kleine-Budde , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Vincent Mailhol , Andy Shevchenko , Oliver Hartkopp , =?UTF-8?q?Stefan=20M=C3=A4tje?= , =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , Sebastian Andrzej Siewior , Christian Pellegrin , linux-can@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4] can: mcp251x: Fix race condition on receive interrupt Date: Thu, 4 Aug 2022 10:14:11 +0200 Message-Id: <20220804081411.68567-1-sebastian.wuerl@ororatech.com> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220804075914.67569-1-sebastian.wuerl@ororatech.com> References: <20220804075914.67569-1-sebastian.wuerl@ororatech.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The mcp251x driver uses both receiving mailboxes of the CAN controller chips. For retrieving the CAN frames from the controller via SPI, it checks once per interrupt which mailboxes have been filled and will retrieve the messages accordingly. This introduces a race condition, as another CAN frame can enter mailbox 1 while mailbox 0 is emptied. If now another CAN frame enters mailbox 0 until the interrupt handler is called next, mailbox 0 is emptied before mailbox 1, leading to out-of-order CAN frames in the network device. This is fixed by checking the interrupt flags once again after freeing mailbox 0, to correctly also empty mailbox 1 before leaving the handler. For reproducing the bug I created the following setup: - Two CAN devices, one Raspberry Pi with MCP2515, the other can be any. - Setup CAN to 1 MHz - Spam bursts of 5 CAN-messages with increasing CAN-ids - Continue sending the bursts while sleeping a second between the bursts - Check on the RPi whether the received messages have increasing CAN-ids - Without this patch, every burst of messages will contain a flipped pair Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of = workqueues.") Signed-off-by: Sebastian W=C3=BCrl --- drivers/net/can/spi/mcp251x.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c index 89897a2d41fa..df748b2e7421 100644 --- a/drivers/net/can/spi/mcp251x.c +++ b/drivers/net/can/spi/mcp251x.c @@ -1068,15 +1068,12 @@ static irqreturn_t mcp251x_can_ist(int irq, void *d= ev_id) mutex_lock(&priv->mcp_lock); while (!priv->force_quit) { enum can_state new_state; - u8 intf, eflag; + u8 intf, intf1, eflag, eflag1; u8 clear_intf =3D 0; int can_id =3D 0, data1 =3D 0; =20 mcp251x_read_2regs(spi, CANINTF, &intf, &eflag); =20 - /* mask out flags we don't care about */ - intf &=3D CANINTF_RX | CANINTF_TX | CANINTF_ERR; - /* receive buffer 0 */ if (intf & CANINTF_RX0IF) { mcp251x_hw_rx(spi, 0); @@ -1086,6 +1083,16 @@ static irqreturn_t mcp251x_can_ist(int irq, void *de= v_id) if (mcp251x_is_2510(spi)) mcp251x_write_bits(spi, CANINTF, CANINTF_RX0IF, 0x00); + + /* check if buffer 1 is already known to be full, no need to re-read */ + if (!(intf & CANINTF_RX1IF)) { + /* intf needs to be read again to avoid a race condition */ + mcp251x_read_2regs(spi, CANINTF, &intf1, &eflag1); + + /* combine flags from both operations for error handling */ + intf |=3D intf1; + eflag |=3D eflag1; + } } =20 /* receive buffer 1 */ @@ -1096,6 +1103,9 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev= _id) clear_intf |=3D CANINTF_RX1IF; } =20 + /* mask out flags we don't care about */ + intf &=3D CANINTF_RX | CANINTF_TX | CANINTF_ERR; + /* any error or tx interrupt we need to clear? */ if (intf & (CANINTF_ERR | CANINTF_TX)) clear_intf |=3D intf & (CANINTF_ERR | CANINTF_TX); --=20 2.30.2