postfix decrement error in smc911x_reset(); drivers/net/smc911x.c
Subsystems (2)
PATCH 1/1 postfix decrement error in smc911x_reset(); drivers/net/smc911x.c
If timeout causes the loop to end, a postfix decrement causes its value to become 4294967295 (unsigned int), not 0.
Signed-off-by Roel Kluin <[email protected]>
---
drivers/net/smc911x.c +1 -1
@@ -243,7 +243,7 @@ static void smc911x_reset(struct net_device *dev)do {udelay (10 ); reg =SMC_GET_PMT_CTRL () &PMT_CTRL_READY_ ; - }while ( timeout-- && !reg); + }while ( --timeout && !reg);if (timeout ==0 ) {PRINTK ("%s: smc911x_reset timeout waiting for PM restore\n" , dev->name);return ;
And there was another one...
--
If timeout causes the loop to end, a postfix decrement causes its value to become 4294967295 (unsigned int), not 0.
Signed-off-by Roel Kluin <[email protected]>
---
drivers/net/smc911x.c +2 -2
@@ -243,7 +243,7 @@ static void smc911x_reset(struct net_device *dev)do {udelay (10 ); reg =SMC_GET_PMT_CTRL () &PMT_CTRL_READY_ ; - }while ( timeout-- && !reg); + }while ( --timeout && !reg);if (timeout ==0 ) {PRINTK ("%s: smc911x_reset timeout waiting for PM restore\n" , dev->name);return ;
@@ -267,7 +267,7 @@ static void smc911x_reset(struct net_device *dev) resets++;break ; } - }while ( timeout-- && (reg &HW_CFG_SRST_ )); + }while ( --timeout && (reg &HW_CFG_SRST_ )); }if (timeout ==0 ) {PRINTK ("%s: smc911x_reset timeout waiting for reset\n" , dev->name);
Darn, another. Sorry for the noise; I also removed a whitespace in this one --
If timeout causes the loop to end, a postfix decrement causes its value to become 4294967295 (unsigned int), not 0.
Signed-off-by Roel Kluin <[email protected]>
---
drivers/net/smc911x.c +3 -3
@@ -243,7 +243,7 @@ static void smc911x_reset(struct net_device *dev)do {udelay (10 ); reg =SMC_GET_PMT_CTRL () &PMT_CTRL_READY_ ; - }while ( timeout-- && !reg); + }while (--timeout && !reg);if (timeout ==0 ) {PRINTK ("%s: smc911x_reset timeout waiting for PM restore\n" , dev->name);return ;
@@ -267,7 +267,7 @@ static void smc911x_reset(struct net_device *dev) resets++;break ; } - }while ( timeout-- && (reg &HW_CFG_SRST_ )); + }while (--timeout && (reg &HW_CFG_SRST_ )); }if (timeout ==0 ) {PRINTK ("%s: smc911x_reset timeout waiting for reset\n" , dev->name);
@@ -413,7 +413,7 @@ static inline void smc911x_drop_pkt(struct net_device *dev)do {udelay (10 ); reg =SMC_GET_RX_DP_CTRL () &RX_DP_CTRL_FFWD_BUSY_ ; - }while ( timeout-- && reg); + }while (--timeout && reg);if (timeout ==0 ) {PRINTK ("%s: timeout waiting for RX fast forward\n" , dev->name); }