On Tue, Apr 14, 2015 at 11:46 AM, Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> wrote:
> Hi Andrey,
>
> On Mon, Apr 13, 2015 at 05:11:50AM -0700, Andrey Smirnov wrote:
>> Fix a bug in fpgamgr_program_write_buf() where .rbf file whose length
>> is not a multiple of 4 would cause an integer overflow which would
>> result in infinite loop.
>>
>> Signed-off-by: Andrey Smirnov <andrew.smirnov@xxxxxxxxx>
>> ---
>> drivers/firmware/socfpga.c | 26 ++++++++++++++++++++++----
>> 1 file changed, 22 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/firmware/socfpga.c b/drivers/firmware/socfpga.c
>> index a5dc607..75fb050 100644
>> --- a/drivers/firmware/socfpga.c
>> +++ b/drivers/firmware/socfpga.c
>> @@ -321,14 +321,32 @@ static int fpgamgr_program_write_buf(struct firmware_handler *fh, const void *bu
>> size_t size)
>> {
>> struct fpgamgr *mgr = container_of(fh, struct fpgamgr, fh);
>> - const uint32_t *buf32 = buf;
>> + const uint8_t *buffer = buf;
>> + uint32_t word;
>> + size_t chunk_size;
>> + size_t offset = 0;
>>
>> /* write to FPGA Manager AXI data */
>> while (size) {
>
> This code probably looks better when you change this loop to
> while (size >= sizeof(uint32_t)){} followed by a if (size) {}
Yeah, I agree. I'll update it in the next version of the patch.
>
>> - writel(*buf32, mgr->regs_data);
>> + chunk_size = min(size, sizeof(uint32_t));
>> + size -= chunk_size;
>> +
>> + if (likely(chunk_size == sizeof(uint32_t))) {
>> + word = *(uint32_t *)(buffer + offset);
>> + offset += sizeof(uint32_t);
>> + } else {
>> + word = buffer[offset++];
>> + word <<= 8;
>> + chunk_size--;
>> +
>> + while (chunk_size--) {
>> + word |= buffer[offset++];
>> + word <<= 8;
>> + }
>
> Isn't this the same as:
>
> word = 0;
> while (chunk_size--) {
> word |= buffer[offset++];
> word <<= 8;
> }
>
That's how I originally wrote it, but then the "unnecessary"
assignment to zero started to bother me for some reason and I
un-rolled one iteration of the loop. I can change it back in the next
version of the patch
>
> Sascha
>
> --
> Pengutronix e.K. | |
> Industrial Linux Solutions | http://www.pengutronix.de/ |
> Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
> Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/barebox
