Re: [PATCH net] can: sja1000: Fix pci_iounmap() buffer

Marc Kleine-Budde
2026-04-01T10:59:33Z

[-- Attachment #1: Type: text/plain, Size: 2253 bytes --]

On 30.03.2026 17:42:31, Thomas Fourier wrote:
> The base_addr is mapped in kvaser_pci_init_one() and the pointer is
> copied to priv->reg_base in kvaser_pci_add_chan() with offset
> channel * KVASER_PCI_PORT_BYTES but unmapped without the offset.
>
> Cancel the offset before calling pci_iounmap().
>
> Fixes: 255a9154319d ("can: sja1000: stop misusing member base_addr of struct net_device")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>

The cleanup functions in this driver are a mess. kvaser_pci_del_chan()
should only delete one channel, but it deletes all. It also unmaps the
iomem, which belongs into kvaser_pci_remove_one().

What about switching the driver to pcim_enable_device(),
pcim_request_region(), pcim_iomap() functions instead?

> ---
> drivers/net/can/sja1000/kvaser_pci.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
> index 95fe9ee1ce32..213fd0eb07e7 100644
> --- a/drivers/net/can/sja1000/kvaser_pci.c
> +++ b/drivers/net/can/sja1000/kvaser_pci.c
> @@ -161,6 +161,7 @@ static void kvaser_pci_del_chan(struct net_device *dev)
> {
> struct sja1000_priv *priv;
> struct kvaser_pci *board;
> + void __iomem *base_addr;
> int i;
>
> if (!dev)
> @@ -186,7 +187,8 @@ static void kvaser_pci_del_chan(struct net_device *dev)
> }
> unregister_sja1000dev(dev);
>
> - pci_iounmap(board->pci_dev, priv->reg_base);
> + base_addr = priv->reg_base - board->channel * KVASER_PCI_PORT_BYTES;
> + pci_iounmap(board->pci_dev, base_addr);

When called from kvaser_pci_remove_one(), "dev" points to the master
dev, which uses priv->reg_base without an offset, as it's board->channel
is "0", right?

When called from the error path of kvaser_pci_add_chan(), things go
wrong, and in the error path of kvaser_pci_init_one(), the pci mem is
unmapped again.

regards,
Marc

--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung Nürnberg | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-9 |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]