Skip to contentSkip to conversation

applicom: Prevent unsigned wrap in ac_interrupt()

PATCH In review Roel Kluin 2 participants 4 messages Aug 8, 2009 – Aug 11, 2009 Char and misc drivers

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 applicom: Prevent unsigned wrap in ac_interrupt()

unsigned i wraps if this occurs in the first iteration.

Signed-off-by Roel Kluin <[email protected]>

---
Or do we know this can't happen?

drivers/char/applicom.c +1 -1
index 73a0765..0df3e12 100644
@@ -670,7 +670,7 @@ static irqreturn_t ac_interrupt(int vec, void *dev_instance)
 			}
 			Dummy = readb(apbs[i].RamIO + VERS);
 
-			if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
+			if(i && readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
 				/* There's another int waiting on this card */
 				spin_unlock(&apbs[i].mutex);
 				i--;
#1 lore raw
Quoted 1 line · Roel Kluin

unsigned i wraps if this occurs in the first iteration.

Could you elaborate? I don't quite understand the point.

Quoted 3 lines
Signed-off-by Roel Kluin <[email protected]>

---
Or do we know this can't happen?

You mean the i--? It's followed by i++ in the for loop 3rd expression. Or?

Quoted 14 lines
drivers/char/applicom.c +1 -1
index 73a0765..0df3e12 100644
@@ -670,7 +670,7 @@ static irqreturn_t ac_interrupt(int vec, void *dev_instance)
 			}
 			Dummy = readb(apbs[i].RamIO + VERS);
 
-			if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
+			if(i && readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
 				/* There's another int waiting on this card */
 				spin_unlock(&apbs[i].mutex);
 				i--;
author
#2 lore raw
Quoted 3 lines
Quoted 1 line

unsigned i wraps if this occurs in the first iteration.

Could you elaborate? I don't quite understand the point.

`i' is unsigned. The last test in the loop is:

if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
        /* There's another int waiting on this card */
        spin_unlock(&apbs[i].mutex);
        i--;
} else {
        spin_unlock(&apbs[i].mutex);
}

In the first iteration i' is 0, so if this condition evaluates to true then i' becomes 0xffffffff (since it's unsigned), the for loop test fails and the i++ never occurs.

Quoted 3 lines
Quoted 1 line

Or do we know this can't happen?

You mean the i--? It's followed by i++ in the for loop 3rd expression. Or?

No, I meant: do we know the test can't evaluate to true in the first iteration?

Thanks,

Roel

#3 lore raw
Quoted 14 lines · roel kluin
Quoted 3 lines
Quoted 1 line

unsigned i wraps if this occurs in the first iteration.

Could you elaborate? I don't quite understand the point.

`i' is unsigned. The last test in the loop is:

if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
        /* There's another int waiting on this card */
        spin_unlock(&apbs[i].mutex);
        i--;
} else {
        spin_unlock(&apbs[i].mutex);
}
Quoted 3 lines

In the first iteration i' is 0, so if this condition evaluates to true then i' becomes 0xffffffff (since it's unsigned), the for loop test fails and the i++ never occurs.

Hmm, no. This is not how three `for' expressions are evaluated. The CFG of "for (a; b; c) d;" is "a->(b->d->c)*". Read 6.8.5.3 of ANSI C99.

I.e. 0xff increments back to 0.

Am I still missing something?