pci: fix address range check in __pci_hose_phys_to_bus()

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Reported-by Ivan Mercier <[email protected]>

Signed-off-by Marcel Ziswiler <[email protected]>

---

 drivers/pci/pci_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/pci/pci_common.c +0 -0

index a64792f..2a14902 100644

Quoted 28 lines · Marcel Ziswiler

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Reported-by Ivan Mercier <[email protected]>

Signed-off-by Marcel Ziswiler <[email protected]>

---

  drivers/pci/pci_common.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/pci/pci_common.c +0 -0

index a64792f..2a14902 100644

drivers/pci/pci_common.c int __pci_hose_phys_to_bus(struct pci_controller *hose,

Quoted 9 lines

drivers/pci/pci_common.c +1 -2

@@ -268,7 +268,7 @@ int __pci_hose_phys_to_bus(struct pci_controller *hose,
                 bus_addr = phys_addr - res->phys_start + res->bus_start;
 
                 if (bus_addr >= res->bus_start &&
-                   bus_addr < res->bus_start + res->size) {
+                   (bus_addr - res->bus_start) < res->size) {
                         *ba = bus_addr;
                         return 0;
                 }
--

Reviewed-by Bin Meng <[email protected]>

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Reported-by Ivan Mercier <[email protected]>

Signed-off-by Marcel Ziswiler <[email protected]>

---

 drivers/pci/pci_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/pci/pci_common.c +0 -0

index a64792f..2a14902 100644

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Quoted 13 lines · Marcel Ziswiler

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

Quoted 3 lines

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Reviewed-by Stephen Warren <[email protected]>

The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages:

Apalis TK1 # tftpboot $loadaddr test_file
Using e1000#0 device
TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'.
Load address: 0x80408000
Loading: pci_hose_phys_to_bus: invalid physical address

This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys().

Reported-by Ivan Mercier <[email protected]>

Signed-off-by Marcel Ziswiler <[email protected]>

Reviewed-by Bin Meng <[email protected]>

Reviewed-by Stephen Warren <[email protected]>

Acked-by Simon Glass <[email protected]>