[PATCH net] can: sja1000: Fix pci_iounmap() buffer

[PATCH net] can: sja1000: Fix pci_iounmap() buffer

[Thomas Fourier]

The base_addr is mapped in kvaser_pci_init_one() and the pointer is
copied to priv->reg_base in kvaser_pci_add_chan() with offset
channel * KVASER_PCI_PORT_BYTES but unmapped without the offset.

Cancel the offset before calling pci_iounmap().

Fixes: 255a9154319d ("can: sja1000: stop misusing member base_addr of struct net_device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/net/can/sja1000/kvaser_pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 95fe9ee1ce32..213fd0eb07e7 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -161,6 +161,7 @@ static void kvaser_pci_del_chan(struct net_device *dev)
 {
 	struct sja1000_priv *priv;
 	struct kvaser_pci *board;
+	void __iomem *base_addr;
 	int i;
 
 	if (!dev)
@@ -186,7 +187,8 @@ static void kvaser_pci_del_chan(struct net_device *dev)
 	}
 	unregister_sja1000dev(dev);
 
-	pci_iounmap(board->pci_dev, priv->reg_base);
+	base_addr = priv->reg_base - board->channel * KVASER_PCI_PORT_BYTES;
+	pci_iounmap(board->pci_dev, base_addr);
 	pci_iounmap(board->pci_dev, board->conf_addr);
 	pci_iounmap(board->pci_dev, board->res_addr);
 
-- 
2.43.0

Re: [PATCH net] can: sja1000: Fix pci_iounmap() buffer

[Markus Elfring]

> The base_addr is mapped in kvaser_pci_init_one() and the pointer is
> copied to priv->reg_base in kvaser_pci_add_chan() with offset
> channel * KVASER_PCI_PORT_BYTES but unmapped without the offset.
> 
> Cancel the offset before calling pci_iounmap().

Which action would indicate “cancelling” here?


Would it occasionally be preferred to specify selected message recipients
also in the header “To”?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0-rc6#n231

Regards,
Markus

Re: [PATCH net] can: sja1000: Fix pci_iounmap() buffer

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 2253 bytes --]

On 30.03.2026 17:42:31, Thomas Fourier wrote:
> The base_addr is mapped in kvaser_pci_init_one() and the pointer is
> copied to priv->reg_base in kvaser_pci_add_chan() with offset
> channel * KVASER_PCI_PORT_BYTES but unmapped without the offset.
>
> Cancel the offset before calling pci_iounmap().
>
> Fixes: 255a9154319d ("can: sja1000: stop misusing member base_addr of struct net_device")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>

The cleanup functions in this driver are a mess. kvaser_pci_del_chan()
should only delete one channel, but it deletes all. It also unmaps the
iomem, which belongs into kvaser_pci_remove_one().

What about switching the driver to pcim_enable_device(),
pcim_request_region(), pcim_iomap() functions instead?

> ---
>  drivers/net/can/sja1000/kvaser_pci.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
> index 95fe9ee1ce32..213fd0eb07e7 100644
> --- a/drivers/net/can/sja1000/kvaser_pci.c
> +++ b/drivers/net/can/sja1000/kvaser_pci.c
> @@ -161,6 +161,7 @@ static void kvaser_pci_del_chan(struct net_device *dev)
>  {
>  	struct sja1000_priv *priv;
>  	struct kvaser_pci *board;
> +	void __iomem *base_addr;
>  	int i;
>
>  	if (!dev)
> @@ -186,7 +187,8 @@ static void kvaser_pci_del_chan(struct net_device *dev)
>  	}
>  	unregister_sja1000dev(dev);
>
> -	pci_iounmap(board->pci_dev, priv->reg_base);
> +	base_addr = priv->reg_base - board->channel * KVASER_PCI_PORT_BYTES;
> +	pci_iounmap(board->pci_dev, base_addr);

When called from kvaser_pci_remove_one(), "dev" points to the master
dev, which uses priv->reg_base without an offset, as it's board->channel
is "0", right?

When called from the error path of kvaser_pci_add_chan(), things go
wrong, and in the error path of kvaser_pci_init_one(), the pci mem is
unmapped again.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH net] can: sja1000: Fix pci_iounmap() buffer

[Thomas Fourier]

On 01/04/2026 12:59, Marc Kleine-Budde wrote:
> The cleanup functions in this driver are a mess. kvaser_pci_del_chan()
> should only delete one channel, but it deletes all. It also unmaps the
> iomem, which belongs into kvaser_pci_remove_one().
I'm not quite sure because  kvaser_pci_init_one() allocs and registers all 
channels, so kvaser_pci_remove_one() should too?

> What about switching the driver to pcim_enable_device(),
> pcim_request_region(), pcim_iomap() functions instead?
I can write a second patch to do so, this would for sure solve the problem. 
Should I? I have no way to test it.

> When called from kvaser_pci_remove_one(), "dev" points to the master
> dev, which uses priv->reg_base without an offset, as it's board->channel
> is "0", right?
I think you are right, the normal path is fine, but not in the error paths for 
devices with channel other than 0.

Regards,
Thomas

> When called from the error path of kvaser_pci_add_chan(), things go
> wrong, and in the error path of kvaser_pci_init_one(), the pci mem is
> unmapped again.
>
> regards,
> Marc
>