linux-kernel - [PATCH can] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de>
Date: Sun, 16 Nov 2025 16:55:26 +0100
From: Marc Kleine-Budde <mkl@...gutronix.de>
To: Vincent Mailhol <mailhol@...nel.org>, Chen-Yu Tsai <wens@...e.org>, 
 Jernej Skrabec <jernej.skrabec@...il.com>, 
 Samuel Holland <samuel@...lland.org>, 
 Gerhard Bertelsmann <info@...hard-bertelsmann.de>, 
 Maxime Ripard <mripard@...nel.org>
Cc: kernel@...gutronix.de, linux-can@...r.kernel.org, 
 linux-arm-kernel@...ts.infradead.org, linux-sunxi@...ts.linux.dev, 
 linux-kernel@...r.kernel.org, stable@...r.kernel.org, 
 Thomas Mühlbacher <tmuehlbacher@...teo.net>, 
 Marc Kleine-Budde <mkl@...gutronix.de>
Subject: [PATCH can] can: sun4i_can: sun4i_can_interrupt(): fix max irq
 loop handling

Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits
to be reset. If we ever reach the condition of handling more than
`SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop body.

This may, among other issues, cause us to never `netif_wake_queue()` again
after a transmission interrupt.

Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
Cc: stable@...r.kernel.org
Co-developed-by: Thomas Mühlbacher <tmuehlbacher@...teo.net>
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@...teo.net>
Signed-off-by: Marc Kleine-Budde <mkl@...gutronix.de>
---
I've ported the fix from the sja1000 driver to the sun4i_can, which based
on the sja1000 driver.
---
 drivers/net/can/sun4i_can.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index 53bfd873de9b..0a7ba0942839 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -657,8 +657,8 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id)
 	u8 isrc, status;
 	int n = 0;
 
-	while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) &&
-	       (n < SUN4I_CAN_MAX_IRQ)) {
+	while ((n < SUN4I_CAN_MAX_IRQ) &&
+	       (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) {
 		n++;
 		status = readl(priv->base + SUN4I_REG_STA_ADDR);
 

---
base-commit: 5442a9da69789741bfda39f34ee7f69552bf0c56
change-id: 20251116-sun4i-fix-loop-f265621b6a99

Best regards,
--  
Marc Kleine-Budde <mkl@...gutronix.de>