From patchwork Mon Jul 15 11:15:08 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hauke Mehrtens X-Patchwork-Id: 2827409 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0A3B59F967 for ; Mon, 15 Jul 2013 11:15:37 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D13FB2010C for ; Mon, 15 Jul 2013 11:15:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8BB8A20158 for ; Mon, 15 Jul 2013 11:15:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755532Ab3GOLPc (ORCPT ); Mon, 15 Jul 2013 07:15:32 -0400 Received: from server19320154104.serverpool.info ([193.201.54.104]:55273 "EHLO hauke-m.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755502Ab3GOLPb (ORCPT ); Mon, 15 Jul 2013 07:15:31 -0400 Received: from localhost (localhost [127.0.0.1]) by hauke-m.de (Postfix) with ESMTP id 4D45B8F65; Mon, 15 Jul 2013 13:15:30 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at hauke-m.de Received: from hauke-m.de ([127.0.0.1]) by localhost (hauke-m.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ALL3V1njfgME; Mon, 15 Jul 2013 13:15:26 +0200 (CEST) Received: from hauke-desktop.lan (spit-414.wohnheim.uni-bremen.de [134.102.133.158]) by hauke-m.de (Postfix) with ESMTPSA id 525C28F66; Mon, 15 Jul 2013 13:15:16 +0200 (CEST) From: Hauke Mehrtens To: linville@tuxdriver.com Cc: linux-wireless@vger.kernel.org, zajec5@gmail.com, Hauke Mehrtens Subject: [PATCH 5/5] bcma: fix handling of big addrl Date: Mon, 15 Jul 2013 13:15:08 +0200 Message-Id: <1373886908-4460-6-git-send-email-hauke@hauke-m.de> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1373886908-4460-1-git-send-email-hauke@hauke-m.de> References: <1373886908-4460-1-git-send-email-hauke@hauke-m.de> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The return value of bcma_erom_get_addr_desc() is a unsigned value and it could wrap around in the two complement writing. This happens for one core in the BCM4708 SoC. Signed-off-by: Hauke Mehrtens --- drivers/bcma/scan.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c index f2f1415..cd6b20f 100644 --- a/drivers/bcma/scan.c +++ b/drivers/bcma/scan.c @@ -213,7 +213,7 @@ static s32 bcma_erom_get_mst_port(struct bcma_bus *bus, u32 __iomem **eromptr) return ent; } -static s32 bcma_erom_get_addr_desc(struct bcma_bus *bus, u32 __iomem **eromptr, +static u32 bcma_erom_get_addr_desc(struct bcma_bus *bus, u32 __iomem **eromptr, u32 type, u8 port) { u32 addrl, addrh, sizel, sizeh = 0; @@ -225,7 +225,7 @@ static s32 bcma_erom_get_addr_desc(struct bcma_bus *bus, u32 __iomem **eromptr, ((ent & SCAN_ADDR_TYPE) != type) || (((ent & SCAN_ADDR_PORT) >> SCAN_ADDR_PORT_SHIFT) != port)) { bcma_erom_push_ent(eromptr); - return -EINVAL; + return (u32)-EINVAL; } addrl = ent & SCAN_ADDR_ADDR; @@ -273,7 +273,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr, struct bcma_device_id *match, int core_num, struct bcma_device *core) { - s32 tmp; + u32 tmp; u8 i, j; s32 cia, cib; u8 ports[2], wrappers[2]; @@ -351,11 +351,11 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr, * the main register space for the core */ tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, 0); - if (tmp <= 0) { + if (tmp == 0 || IS_ERR_VALUE(tmp)) { /* Try again to see if it is a bridge */ tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_BRIDGE, 0); - if (tmp <= 0) { + if (tmp == 0 || IS_ERR_VALUE(tmp)) { return -EILSEQ; } else { bcma_info(bus, "Bridge found\n"); @@ -369,7 +369,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr, for (j = 0; ; j++) { tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, i); - if (tmp < 0) { + if (IS_ERR_VALUE(tmp)) { /* no more entries for port _i_ */ /* pr_debug("erom: slave port %d " * "has %d descriptors\n", i, j); */ @@ -386,7 +386,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr, for (j = 0; ; j++) { tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_MWRAP, i); - if (tmp < 0) { + if (IS_ERR_VALUE(tmp)) { /* no more entries for port _i_ */ /* pr_debug("erom: master wrapper %d " * "has %d descriptors\n", i, j); */ @@ -404,7 +404,7 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr, for (j = 0; ; j++) { tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SWRAP, i + hack); - if (tmp < 0) { + if (IS_ERR_VALUE(tmp)) { /* no more entries for port _i_ */ /* pr_debug("erom: master wrapper %d " * has %d descriptors\n", i, j); */