New: flexcan-core.c overflow when writing TDCOFF

Begin forwarded message:

Date: Wed, 28 May 2025 15:30:12 +0000
From: [email protected]
To: [email protected]
Subject: [Bug 220170] New: flexcan-core.c overflow when writing TDCOFF

https://bugzilla.kernel.org/show_bug.cgi?id=220170

            Bug ID: 220170
           Summary: flexcan-core.c overflow when writing TDCOFF
           Product: Networking
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Other
          Assignee: [email protected]
          Reporter: [email protected]
        Regression: No

When we run:

ip link set can0 up type can tq 100 prop-seg 41 phase-seg1 2 phase-seg2 6 sjw 2 dtq 50 dprop-seg 7 dphase-seg1 8 dphase-seg2 4 dsjw 2 restart-ms 1000 berr-reporting on fd on
--> FLEXCAN_FDCTRL_TCOFF = 32 but gets cut off in the bitfield to 0 because the bitfield is only 5 bits wide.

FLEXCAN_FDCTRL_TDCOFF is 5bits.
#define FLEXCAN_FDCTRL_TDCOFF GENMASK(12, 8)

logs:

[   96.263214] flexcan 425b0000.can can0: writing ctrl=0x034d0050
[   96.263235] flexcan 425b0000.can can0: writing cbt=0x8061a025
[   96.263241] flexcan 425b0000.can can0: Data brp=2 and brp=4 don't match,
this may result in a phase error. Consider using different bitrate and/or data
bitrate.
[   96.263248] flexcan 425b0000.can can0: writing fdcbt=0x00111ce3
[   96.263253] flexcan 425b0000.can can0: writing ctrl2=0x00631000
[   96.263257] flexcan 425b0000.can can0: writing fdctrl=0x801b8000

(0x801b8000 1000000000011011100 00000 00000000)

[   96.263263] flexcan 425b0000.can can0: flexcan_set_bittiming_cbt:
mcr=0x5980000f ctrl=0x034d0050 ctrl2=0x00631000 fdctrl=0x801b8000
cbt=0x8061a025 fdcbt=0x00111ce3
[   96.263271] flexcan 425b0000.can can0: flexcan_chip_start: writing
mcr=0x59a30a0d
[   96.263276] flexcan 425b0000.can can0: flexcan_chip_start: writing
ctrl=0x034d0050
[   96.263281] flexcan 425b0000.can can0: flexcan_chip_start: writing
fdctrl=0x801b8000
[   96.263302] flexcan 425b0000.can can0: flexcan_chip_start: reading

mcr=0x40a30a0d ctrl=0x034d0050

Since its 5bits, we are indeed less flexibel regarding setting the parameters. But i think there should be some checks on the input values instead of accepting these resulting in a
FLEXCAN_FDCTRL_TDCOFF of 0.

Kind regards,

Robbin

You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.