Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e4bb688d9f11d7fee927312cc97d443472c7c212
Commit:     e4bb688d9f11d7fee927312cc97d443472c7c212
Parent:     3c5f6162549b9045a2925dff64c140c7f49ea344
Author:     Scott Wood <[EMAIL PROTECTED]>
AuthorDate: Fri Apr 27 03:08:13 2007 +1000
Committer:  Paul Mackerras <[EMAIL PROTECTED]>
CommitDate: Fri Apr 27 21:13:56 2007 +1000

    [POWERPC] bootwrapper: Fix array handling in dt_xlate_reg().
    
    This fixes a few bugs in how dt_xlate_reg() handles address arrays:
    
    1. copy_val() was copying into the wrong end of the array, resulting
    in random stack garbage at the other end.
    2. dt_xlate_reg() was getting the result from the wrong end of the array.
    3. add_reg() and sub_reg() were treating the arrays as
    little-endian rather than big-endian.
    4. add_reg() only returned an error on a carry out of the entire
    array, rather than out of the naddr portion.
    5. The requested reg resource was checked to see if it exceeded
    the size of the reg property, but not to see if it exceeded the
    size of the buffer.
    
    Signed-off-by: Scott Wood <[EMAIL PROTECTED]>
    Signed-off-by: Paul Mackerras <[EMAIL PROTECTED]>
---
 arch/powerpc/boot/devtree.c |   23 +++++++++++------------
 1 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c
index 23492d7..ac4b5ee 100644
--- a/arch/powerpc/boot/devtree.c
+++ b/arch/powerpc/boot/devtree.c
@@ -123,15 +123,17 @@ static void get_reg_format(void *node, u32 *naddr, u32 
*nsize)
 
 static void copy_val(u32 *dest, u32 *src, int naddr)
 {
-       memset(dest, 0, (MAX_ADDR_CELLS - naddr) * 4);
-       memcpy(dest, src, naddr * 4);
+       int pad = MAX_ADDR_CELLS - naddr;
+
+       memset(dest, 0, pad * 4);
+       memcpy(dest + pad, src, naddr * 4);
 }
 
 static int sub_reg(u32 *reg, u32 *sub)
 {
        int i, borrow = 0;
 
-       for (i = 0; i < MAX_ADDR_CELLS; i++) {
+       for (i = MAX_ADDR_CELLS - 1; i >= 0; i--) {
                int prev_borrow = borrow;
                borrow = reg[i] < sub[i] + prev_borrow;
                reg[i] -= sub[i] + prev_borrow;
@@ -140,11 +142,11 @@ static int sub_reg(u32 *reg, u32 *sub)
        return !borrow;
 }
 
-static int add_reg(u32 *reg, u32 *add)
+static int add_reg(u32 *reg, u32 *add, int naddr)
 {
        int i, carry = 0;
 
-       for (i = 0; i < MAX_ADDR_CELLS; i++) {
+       for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) {
                u64 tmp = (u64)reg[i] + add[i] + carry;
                carry = tmp >> 32;
                reg[i] = (u32)tmp;
@@ -228,7 +230,8 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr,
        buflen = getprop(node, "reg", buf, sizeof(buf)) / 4;
        offset = (naddr + nsize) * res;
 
-       if (buflen < offset + naddr + nsize)
+       if (buflen < offset + naddr + nsize ||
+           sizeof(buf) < offset + naddr + nsize)
                return 0;
 
        copy_val(last_addr, buf + offset, naddr);
@@ -263,18 +266,14 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr,
 
                copy_val(this_addr, buf + offset + prev_naddr, naddr);
 
-               if (!add_reg(last_addr, this_addr))
+               if (!add_reg(last_addr, this_addr, naddr))
                        return 0;
        }
 
        if (naddr > 2)
                return 0;
 
-       ret_addr = last_addr[0];
-       if (naddr == 2) {
-               ret_addr <<= 32;
-               ret_addr |= last_addr[1];
-       }
+       ret_addr = ((u64)last_addr[2] << 32) | last_addr[3];
 
        if (sizeof(void *) == 4 &&
            (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL ||
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to