Re: [PATCH net] can: sja1000: Fix pci_iounmap() buffer

[Marc Kleine-Budde]

On 30.03.2026 17:42:31, Thomas Fourier wrote:
> The base_addr is mapped in kvaser_pci_init_one() and the pointer is
> copied to priv->reg_base in kvaser_pci_add_chan() with offset
> channel * KVASER_PCI_PORT_BYTES but unmapped without the offset.
>
> Cancel the offset before calling pci_iounmap().
>
> Fixes: 255a9154319d ("can: sja1000: stop misusing member base_addr of struct net_device")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Thomas Fourier <fourier.thomas@xxxxxxxxx>

The cleanup functions in this driver are a mess. kvaser_pci_del_chan()
should only delete one channel, but it deletes all. It also unmaps the
iomem, which belongs into kvaser_pci_remove_one().

What about switching the driver to pcim_enable_device(),
pcim_request_region(), pcim_iomap() functions instead?

> ---
>  drivers/net/can/sja1000/kvaser_pci.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
> index 95fe9ee1ce32..213fd0eb07e7 100644
> --- a/drivers/net/can/sja1000/kvaser_pci.c
> +++ b/drivers/net/can/sja1000/kvaser_pci.c
> @@ -161,6 +161,7 @@ static void kvaser_pci_del_chan(struct net_device *dev)
>  {
>  	struct sja1000_priv *priv;
>  	struct kvaser_pci *board;
> +	void __iomem *base_addr;
>  	int i;
>
>  	if (!dev)
> @@ -186,7 +187,8 @@ static void kvaser_pci_del_chan(struct net_device *dev)
>  	}
>  	unregister_sja1000dev(dev);
>
> -	pci_iounmap(board->pci_dev, priv->reg_base);
> +	base_addr = priv->reg_base - board->channel * KVASER_PCI_PORT_BYTES;
> +	pci_iounmap(board->pci_dev, base_addr);

When called from kvaser_pci_remove_one(), "dev" points to the master
dev, which uses priv->reg_base without an offset, as it's board->channel
is "0", right?

When called from the error path of kvaser_pci_add_chan(), things go
wrong, and in the error path of kvaser_pci_init_one(), the pci mem is
unmapped again.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature