summaryrefslogtreecommitdiff
path: root/drivers/mtd
diff options
context:
space:
mode:
authorBrian Norris <computersforpeace@gmail.com>2014-05-21 09:47:26 +0400
committerBrian Norris <computersforpeace@gmail.com>2014-05-28 11:05:26 +0400
commitab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff (patch)
tree7cfeb29c8fe79ebc80e743b79b901037baf5c2bc /drivers/mtd
parentabb9cf78e80ab4407c3efb0950f08e6941bc7e73 (diff)
downloadlinux-ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff.tar.xz
mtd: nand: r852: correct write_buf loop bounds
The two loops in r852_write_buf() are designed to handle 4-byte-aligned and then 1-byte-aligned portions, respectively. However, there are two issues: (1) The first loop will only terminate if 'len' is a multiple of 4 (2) The second loop will never terminate if it runs at least once Rewrite these loops as they were probably intended. Compile tested only. Issues pointed out by Coverity Scan. Signed-off-by: Brian Norris <computersforpeace@gmail.com> Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/nand/r852.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 325930db3f04..baea83f4dea8 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -245,7 +245,7 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
}
/* write DWORD chinks - faster */
- while (len) {
+ while (len >= 4) {
reg = buf[0] | buf[1] << 8 | buf[2] << 16 | buf[3] << 24;
r852_write_reg_dword(dev, R852_DATALINE, reg);
buf += 4;
@@ -254,8 +254,10 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
}
/* write rest */
- while (len)
+ while (len > 0) {
r852_write_reg(dev, R852_DATALINE, *buf++);
+ len--;
+ }
}
/*