Commit e04b2cfe authored May 05, 2021 by Marc Kleine-Budde

can: m_can: m_can_tx_work_queue(): fix tx_skb race condition



The m_can_start_xmit() function checks if the cdev->tx_skb is NULL and
returns with NETDEV_TX_BUSY in case tx_sbk is not NULL.

There is a race condition in the m_can_tx_work_queue(), where first
the skb is send to the driver and then the case tx_sbk is set to NULL.
A TX complete IRQ might come in between and wake the queue, which
results in tx_skb not being cleared yet.

Fixes: f524f829 ("can: m_can: Create a m_can platform framework")
Tested-by: Torin Cooper-Bennun <torin@maxiluxsystems.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

parent 03c42714

drivers/net/can/m_can/m_can.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1562,6 +1562,8 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)
		int i;
		int putidx;

		cdev->tx_skb = NULL;

		/* Generate ID field for TX buffer Element */
		/* Common to all supported M_CAN versions */
		if (cf->can_id & CAN_EFF_FLAG) {
		@@ -1678,7 +1680,6 @@ static void m_can_tx_work_queue(struct work_struct *ws)
		tx_work);

		m_can_tx_handler(cdev);
		cdev->tx_skb = NULL;
		}

		static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,