diff options
| author | Brian Norris <computersforpeace@gmail.com> | 2014-05-20 22:47:26 -0700 |
|---|---|---|
| committer | Brian Norris <computersforpeace@gmail.com> | 2014-05-28 00:05:26 -0700 |
| commit | ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff (patch) | |
| tree | 7cfeb29c8fe79ebc80e743b79b901037baf5c2bc /drivers/mtd | |
| parent | abb9cf78e80ab4407c3efb0950f08e6941bc7e73 (diff) | |
| download | op-kernel-dev-ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff.zip op-kernel-dev-ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff.tar.gz | |
mtd: nand: r852: correct write_buf loop bounds
The two loops in r852_write_buf() are designed to handle 4-byte-aligned
and then 1-byte-aligned portions, respectively. However, there are two
issues:
(1) The first loop will only terminate if 'len' is a multiple of 4
(2) The second loop will never terminate if it runs at least once
Rewrite these loops as they were probably intended. Compile tested only.
Issues pointed out by Coverity Scan.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/nand/r852.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c index 325930d..baea83f 100644 --- a/drivers/mtd/nand/r852.c +++ b/drivers/mtd/nand/r852.c @@ -245,7 +245,7 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len) } /* write DWORD chinks - faster */ - while (len) { + while (len >= 4) { reg = buf[0] | buf[1] << 8 | buf[2] << 16 | buf[3] << 24; r852_write_reg_dword(dev, R852_DATALINE, reg); buf += 4; @@ -254,8 +254,10 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len) } /* write rest */ - while (len) + while (len > 0) { r852_write_reg(dev, R852_DATALINE, *buf++); + len--; + } } /* |
