Commit 47235841 authored by Bjorn Helgaas's avatar Bjorn Helgaas

Merge branches 'pci/hotplug' and 'pci/resource' into next

* pci/hotplug:
  PCI: ibmphp: Remove unneeded NULL test
  PCI: hotplug: Use list_for_each_entry() to simplify code
  PCI: acpiphp_ibm: Fix null dereferences on null ibm_slot

* pci/resource:
  PCI: Avoid iterating through memory outside the resource window
  PCI: Fix minimum allocation address overwrite
...@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, ...@@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
type_mask |= IORESOURCE_TYPE_BITS; type_mask |= IORESOURCE_TYPE_BITS;
pci_bus_for_each_resource(bus, r, i) { pci_bus_for_each_resource(bus, r, i) {
resource_size_t min_used = min;
if (!r) if (!r)
continue; continue;
...@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res, ...@@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
* overrides "min". * overrides "min".
*/ */
if (avail.start) if (avail.start)
min = avail.start; min_used = avail.start;
max = avail.end; max = avail.end;
/* Ok, try it out.. */ /* Ok, try it out.. */
ret = allocate_resource(r, res, size, min, max, ret = allocate_resource(r, res, size, min_used, max,
align, alignf, alignf_data); align, alignf, alignf_data);
if (ret == 0) if (ret == 0)
return 0; return 0;
......
...@@ -154,7 +154,8 @@ static union apci_descriptor *ibm_slot_from_id(int id) ...@@ -154,7 +154,8 @@ static union apci_descriptor *ibm_slot_from_id(int id)
ibm_slot_done: ibm_slot_done:
if (ret) { if (ret) {
ret = kmalloc(sizeof(union apci_descriptor), GFP_KERNEL); ret = kmalloc(sizeof(union apci_descriptor), GFP_KERNEL);
memcpy(ret, des, sizeof(union apci_descriptor)); if (ret)
memcpy(ret, des, sizeof(union apci_descriptor));
} }
kfree(table); kfree(table);
return ret; return ret;
...@@ -175,8 +176,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status) ...@@ -175,8 +176,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
acpi_status stat; acpi_status stat;
unsigned long long rc; unsigned long long rc;
union apci_descriptor *ibm_slot; union apci_descriptor *ibm_slot;
int id = hpslot_to_sun(slot);
ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot)); ibm_slot = ibm_slot_from_id(id);
if (!ibm_slot) {
pr_err("APLS null ACPI descriptor for slot %d\n", id);
return -ENODEV;
}
pr_debug("%s: set slot %d (%d) attention status to %d\n", __func__, pr_debug("%s: set slot %d (%d) attention status to %d\n", __func__,
ibm_slot->slot.slot_num, ibm_slot->slot.slot_id, ibm_slot->slot.slot_num, ibm_slot->slot.slot_id,
...@@ -215,8 +221,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status) ...@@ -215,8 +221,13 @@ static int ibm_set_attention_status(struct hotplug_slot *slot, u8 status)
static int ibm_get_attention_status(struct hotplug_slot *slot, u8 *status) static int ibm_get_attention_status(struct hotplug_slot *slot, u8 *status)
{ {
union apci_descriptor *ibm_slot; union apci_descriptor *ibm_slot;
int id = hpslot_to_sun(slot);
ibm_slot = ibm_slot_from_id(hpslot_to_sun(slot)); ibm_slot = ibm_slot_from_id(id);
if (!ibm_slot) {
pr_err("APLS null ACPI descriptor for slot %d\n", id);
return -ENODEV;
}
if (ibm_slot->slot.attn & 0xa0 || ibm_slot->slot.status[1] & 0x08) if (ibm_slot->slot.attn & 0xa0 || ibm_slot->slot.status[1] & 0x08)
*status = 1; *status = 1;
......
...@@ -116,11 +116,9 @@ static inline int slot_update(struct slot **sl) ...@@ -116,11 +116,9 @@ static inline int slot_update(struct slot **sl)
static int __init get_max_slots (void) static int __init get_max_slots (void)
{ {
struct slot *slot_cur; struct slot *slot_cur;
struct list_head *tmp;
u8 slot_count = 0; u8 slot_count = 0;
list_for_each(tmp, &ibmphp_slot_head) { list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
/* sometimes the hot-pluggable slots start with 4 (not always from 1) */ /* sometimes the hot-pluggable slots start with 4 (not always from 1) */
slot_count = max(slot_count, slot_cur->number); slot_count = max(slot_count, slot_cur->number);
} }
...@@ -501,16 +499,10 @@ static int get_bus_name(struct hotplug_slot *hotplug_slot, char *value) ...@@ -501,16 +499,10 @@ static int get_bus_name(struct hotplug_slot *hotplug_slot, char *value)
static int __init init_ops(void) static int __init init_ops(void)
{ {
struct slot *slot_cur; struct slot *slot_cur;
struct list_head *tmp;
int retval; int retval;
int rc; int rc;
list_for_each(tmp, &ibmphp_slot_head) { list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
if (!slot_cur)
return -ENODEV;
debug("BEFORE GETTING SLOT STATUS, slot # %x\n", debug("BEFORE GETTING SLOT STATUS, slot # %x\n",
slot_cur->number); slot_cur->number);
if (slot_cur->ctrl->revision == 0xFF) if (slot_cur->ctrl->revision == 0xFF)
...@@ -669,9 +661,7 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function) ...@@ -669,9 +661,7 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function)
{ {
struct pci_func *func_cur; struct pci_func *func_cur;
struct slot *slot_cur; struct slot *slot_cur;
struct list_head *tmp; list_for_each_entry(slot_cur, &ibmphp_slot_head, ibm_slot_list) {
list_for_each(tmp, &ibmphp_slot_head) {
slot_cur = list_entry(tmp, struct slot, ibm_slot_list);
if (slot_cur->func) { if (slot_cur->func) {
func_cur = slot_cur->func; func_cur = slot_cur->func;
while (func_cur) { while (func_cur) {
...@@ -693,14 +683,12 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function) ...@@ -693,14 +683,12 @@ static struct pci_func *ibm_slot_find(u8 busno, u8 device, u8 function)
*************************************************************/ *************************************************************/
static void free_slots(void) static void free_slots(void)
{ {
struct slot *slot_cur; struct slot *slot_cur, *next;
struct list_head *tmp;
struct list_head *next;
debug("%s -- enter\n", __func__); debug("%s -- enter\n", __func__);
list_for_each_safe(tmp, next, &ibmphp_slot_head) { list_for_each_entry_safe(slot_cur, next, &ibmphp_slot_head,
slot_cur = list_entry(tmp, struct slot, ibm_slot_list); ibm_slot_list) {
pci_hp_deregister(slot_cur->hotplug_slot); pci_hp_deregister(slot_cur->hotplug_slot);
} }
debug("%s -- exit\n", __func__); debug("%s -- exit\n", __func__);
......
...@@ -1117,25 +1117,21 @@ int ibmphp_get_bus_index (u8 num) ...@@ -1117,25 +1117,21 @@ int ibmphp_get_bus_index (u8 num)
void ibmphp_free_bus_info_queue (void) void ibmphp_free_bus_info_queue (void)
{ {
struct bus_info *bus_info; struct bus_info *bus_info, *next;
struct list_head *list;
struct list_head *next;
list_for_each_safe (list, next, &bus_info_head ) { list_for_each_entry_safe(bus_info, next, &bus_info_head,
bus_info = list_entry (list, struct bus_info, bus_info_list); bus_info_list) {
kfree (bus_info); kfree (bus_info);
} }
} }
void ibmphp_free_ebda_hpc_queue (void) void ibmphp_free_ebda_hpc_queue (void)
{ {
struct controller *controller = NULL; struct controller *controller = NULL, *next;
struct list_head *list;
struct list_head *next;
int pci_flag = 0; int pci_flag = 0;
list_for_each_safe (list, next, &ebda_hpc_head) { list_for_each_entry_safe(controller, next, &ebda_hpc_head,
controller = list_entry (list, struct controller, ebda_hpc_list); ebda_hpc_list) {
if (controller->ctlr_type == 0) if (controller->ctlr_type == 0)
release_region (controller->u.isa_ctlr.io_start, (controller->u.isa_ctlr.io_end - controller->u.isa_ctlr.io_start + 1)); release_region (controller->u.isa_ctlr.io_start, (controller->u.isa_ctlr.io_end - controller->u.isa_ctlr.io_start + 1));
else if ((controller->ctlr_type == 1) && (!pci_flag)) { else if ((controller->ctlr_type == 1) && (!pci_flag)) {
...@@ -1148,12 +1144,10 @@ void ibmphp_free_ebda_hpc_queue (void) ...@@ -1148,12 +1144,10 @@ void ibmphp_free_ebda_hpc_queue (void)
void ibmphp_free_ebda_pci_rsrc_queue (void) void ibmphp_free_ebda_pci_rsrc_queue (void)
{ {
struct ebda_pci_rsrc *resource; struct ebda_pci_rsrc *resource, *next;
struct list_head *list;
struct list_head *next;
list_for_each_safe (list, next, &ibmphp_ebda_pci_rsrc_head) { list_for_each_entry_safe(resource, next, &ibmphp_ebda_pci_rsrc_head,
resource = list_entry (list, struct ebda_pci_rsrc, ebda_pci_rsrc_list); ebda_pci_rsrc_list) {
kfree (resource); kfree (resource);
resource = NULL; resource = NULL;
} }
......
...@@ -537,7 +537,6 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus) ...@@ -537,7 +537,6 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus)
{ {
void __iomem *wpg_bbar = NULL; void __iomem *wpg_bbar = NULL;
struct controller *ctlr_ptr; struct controller *ctlr_ptr;
struct list_head *pslotlist;
u8 index, status; u8 index, status;
int rc = 0; int rc = 0;
int busindex; int busindex;
...@@ -628,8 +627,8 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus) ...@@ -628,8 +627,8 @@ int ibmphp_hpc_readslot (struct slot *pslot, u8 cmd, u8 *pstatus)
// Not used // Not used
case READ_ALLSLOT: case READ_ALLSLOT:
list_for_each (pslotlist, &ibmphp_slot_head) { list_for_each_entry(pslot, &ibmphp_slot_head,
pslot = list_entry (pslotlist, struct slot, ibm_slot_list); ibm_slot_list) {
index = pslot->ctlr_index; index = pslot->ctlr_index;
rc = hpc_wait_ctlr_notworking (HPC_CTLR_WORKING_TOUT, ctlr_ptr, rc = hpc_wait_ctlr_notworking (HPC_CTLR_WORKING_TOUT, ctlr_ptr,
wpg_bbar, &status); wpg_bbar, &status);
...@@ -820,7 +819,6 @@ static int poll_hpc(void *data) ...@@ -820,7 +819,6 @@ static int poll_hpc(void *data)
{ {
struct slot myslot; struct slot myslot;
struct slot *pslot = NULL; struct slot *pslot = NULL;
struct list_head *pslotlist;
int rc; int rc;
int poll_state = POLL_LATCH_REGISTER; int poll_state = POLL_LATCH_REGISTER;
u8 oldlatchlow = 0x00; u8 oldlatchlow = 0x00;
...@@ -838,10 +836,10 @@ static int poll_hpc(void *data) ...@@ -838,10 +836,10 @@ static int poll_hpc(void *data)
case POLL_LATCH_REGISTER: case POLL_LATCH_REGISTER:
oldlatchlow = curlatchlow; oldlatchlow = curlatchlow;
ctrl_count = 0x00; ctrl_count = 0x00;
list_for_each (pslotlist, &ibmphp_slot_head) { list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
if (ctrl_count >= ibmphp_get_total_controllers()) if (ctrl_count >= ibmphp_get_total_controllers())
break; break;
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
if (pslot->ctrl->ctlr_relative_id == ctrl_count) { if (pslot->ctrl->ctlr_relative_id == ctrl_count) {
ctrl_count++; ctrl_count++;
if (READ_SLOT_LATCH (pslot->ctrl)) { if (READ_SLOT_LATCH (pslot->ctrl)) {
...@@ -859,8 +857,8 @@ static int poll_hpc(void *data) ...@@ -859,8 +857,8 @@ static int poll_hpc(void *data)
poll_state = POLL_SLEEP; poll_state = POLL_SLEEP;
break; break;
case POLL_SLOTS: case POLL_SLOTS:
list_for_each (pslotlist, &ibmphp_slot_head) { list_for_each_entry(pslot, &ibmphp_slot_head,
pslot = list_entry (pslotlist, struct slot, ibm_slot_list); ibm_slot_list) {
// make a copy of the old status // make a copy of the old status
memcpy ((void *) &myslot, (void *) pslot, memcpy ((void *) &myslot, (void *) pslot,
sizeof (struct slot)); sizeof (struct slot));
...@@ -870,10 +868,10 @@ static int poll_hpc(void *data) ...@@ -870,10 +868,10 @@ static int poll_hpc(void *data)
process_changeinstatus (pslot, &myslot); process_changeinstatus (pslot, &myslot);
} }
ctrl_count = 0x00; ctrl_count = 0x00;
list_for_each (pslotlist, &ibmphp_slot_head) { list_for_each_entry(pslot, &ibmphp_slot_head,
ibm_slot_list) {
if (ctrl_count >= ibmphp_get_total_controllers()) if (ctrl_count >= ibmphp_get_total_controllers())
break; break;
pslot = list_entry (pslotlist, struct slot, ibm_slot_list);
if (pslot->ctrl->ctlr_relative_id == ctrl_count) { if (pslot->ctrl->ctlr_relative_id == ctrl_count) {
ctrl_count++; ctrl_count++;
if (READ_SLOT_LATCH (pslot->ctrl)) if (READ_SLOT_LATCH (pslot->ctrl))
......
...@@ -203,15 +203,13 @@ int __init ibmphp_rsrc_init (void) ...@@ -203,15 +203,13 @@ int __init ibmphp_rsrc_init (void)
struct bus_node *newbus = NULL; struct bus_node *newbus = NULL;
struct bus_node *bus_cur; struct bus_node *bus_cur;
struct bus_node *bus_prev; struct bus_node *bus_prev;
struct list_head *tmp;
struct resource_node *new_io = NULL; struct resource_node *new_io = NULL;
struct resource_node *new_mem = NULL; struct resource_node *new_mem = NULL;
struct resource_node *new_pfmem = NULL; struct resource_node *new_pfmem = NULL;
int rc; int rc;
struct list_head *tmp_ebda;
list_for_each (tmp_ebda, &ibmphp_ebda_pci_rsrc_head) { list_for_each_entry(curr, &ibmphp_ebda_pci_rsrc_head,
curr = list_entry (tmp_ebda, struct ebda_pci_rsrc, ebda_pci_rsrc_list); ebda_pci_rsrc_list) {
if (!(curr->rsrc_type & PCIDEVMASK)) { if (!(curr->rsrc_type & PCIDEVMASK)) {
/* EBDA still lists non PCI devices, so ignore... */ /* EBDA still lists non PCI devices, so ignore... */
debug ("this is not a PCI DEVICE in rsrc_init, please take care\n"); debug ("this is not a PCI DEVICE in rsrc_init, please take care\n");
...@@ -369,8 +367,7 @@ int __init ibmphp_rsrc_init (void) ...@@ -369,8 +367,7 @@ int __init ibmphp_rsrc_init (void)
} }
} }
list_for_each (tmp, &gbuses) { list_for_each_entry(bus_cur, &gbuses, bus_list) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
/* This is to get info about PPB resources, since EBDA doesn't put this info into the primary bus info */ /* This is to get info about PPB resources, since EBDA doesn't put this info into the primary bus info */
rc = update_bridge_ranges (&bus_cur); rc = update_bridge_ranges (&bus_cur);
if (rc) if (rc)
...@@ -1571,19 +1568,16 @@ int ibmphp_find_resource (struct bus_node *bus, u32 start_address, struct resour ...@@ -1571,19 +1568,16 @@ int ibmphp_find_resource (struct bus_node *bus, u32 start_address, struct resour
***********************************************************************/ ***********************************************************************/
void ibmphp_free_resources (void) void ibmphp_free_resources (void)
{ {
struct bus_node *bus_cur = NULL; struct bus_node *bus_cur = NULL, *next;
struct bus_node *bus_tmp; struct bus_node *bus_tmp;
struct range_node *range_cur; struct range_node *range_cur;
struct range_node *range_tmp; struct range_node *range_tmp;
struct resource_node *res_cur; struct resource_node *res_cur;
struct resource_node *res_tmp; struct resource_node *res_tmp;
struct list_head *tmp;
struct list_head *next;
int i = 0; int i = 0;
flags = 1; flags = 1;
list_for_each_safe (tmp, next, &gbuses) { list_for_each_entry_safe(bus_cur, next, &gbuses, bus_list) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
if (bus_cur->noIORanges) { if (bus_cur->noIORanges) {
range_cur = bus_cur->rangeIO; range_cur = bus_cur->rangeIO;
for (i = 0; i < bus_cur->noIORanges; i++) { for (i = 0; i < bus_cur->noIORanges; i++) {
...@@ -1691,10 +1685,8 @@ static int __init once_over (void) ...@@ -1691,10 +1685,8 @@ static int __init once_over (void)
struct resource_node *pfmem_prev; struct resource_node *pfmem_prev;
struct resource_node *mem; struct resource_node *mem;
struct bus_node *bus_cur; struct bus_node *bus_cur;
struct list_head *tmp;
list_for_each (tmp, &gbuses) { list_for_each_entry(bus_cur, &gbuses, bus_list) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
if ((!bus_cur->rangePFMem) && (bus_cur->firstPFMem)) { if ((!bus_cur->rangePFMem) && (bus_cur->firstPFMem)) {
for (pfmem_cur = bus_cur->firstPFMem, pfmem_prev = NULL; pfmem_cur; pfmem_prev = pfmem_cur, pfmem_cur = pfmem_cur->next) { for (pfmem_cur = bus_cur->firstPFMem, pfmem_prev = NULL; pfmem_cur; pfmem_prev = pfmem_cur, pfmem_cur = pfmem_cur->next) {
pfmem_cur->fromMem = 1; pfmem_cur->fromMem = 1;
...@@ -1767,14 +1759,10 @@ struct bus_node *ibmphp_find_res_bus (u8 bus_number) ...@@ -1767,14 +1759,10 @@ struct bus_node *ibmphp_find_res_bus (u8 bus_number)
static struct bus_node *find_bus_wprev (u8 bus_number, struct bus_node **prev, u8 flag) static struct bus_node *find_bus_wprev (u8 bus_number, struct bus_node **prev, u8 flag)
{ {
struct bus_node *bus_cur; struct bus_node *bus_cur;
struct list_head *tmp;
struct list_head *tmp_prev;
list_for_each (tmp, &gbuses) { list_for_each_entry(bus_cur, &gbuses, bus_list) {
tmp_prev = tmp->prev;
bus_cur = list_entry (tmp, struct bus_node, bus_list);
if (flag) if (flag)
*prev = list_entry (tmp_prev, struct bus_node, bus_list); *prev = list_prev_entry(bus_cur, bus_list);
if (bus_cur->busno == bus_number) if (bus_cur->busno == bus_number)
return bus_cur; return bus_cur;
} }
...@@ -1788,7 +1776,6 @@ void ibmphp_print_test (void) ...@@ -1788,7 +1776,6 @@ void ibmphp_print_test (void)
struct bus_node *bus_cur = NULL; struct bus_node *bus_cur = NULL;
struct range_node *range; struct range_node *range;
struct resource_node *res; struct resource_node *res;
struct list_head *tmp;
debug_pci ("*****************START**********************\n"); debug_pci ("*****************START**********************\n");
...@@ -1797,8 +1784,7 @@ void ibmphp_print_test (void) ...@@ -1797,8 +1784,7 @@ void ibmphp_print_test (void)
return; return;
} }
list_for_each (tmp, &gbuses) { list_for_each_entry(bus_cur, &gbuses, bus_list) {
bus_cur = list_entry (tmp, struct bus_node, bus_list);
debug_pci ("This is bus # %d. There are\n", bus_cur->busno); debug_pci ("This is bus # %d. There are\n", bus_cur->busno);
debug_pci ("IORanges = %d\t", bus_cur->noIORanges); debug_pci ("IORanges = %d\t", bus_cur->noIORanges);
debug_pci ("MemRanges = %d\t", bus_cur->noMemRanges); debug_pci ("MemRanges = %d\t", bus_cur->noMemRanges);
......
...@@ -396,10 +396,8 @@ static void fs_remove_slot(struct pci_slot *pci_slot) ...@@ -396,10 +396,8 @@ static void fs_remove_slot(struct pci_slot *pci_slot)
static struct hotplug_slot *get_slot_from_name(const char *name) static struct hotplug_slot *get_slot_from_name(const char *name)
{ {
struct hotplug_slot *slot; struct hotplug_slot *slot;
struct list_head *tmp;
list_for_each(tmp, &pci_hotplug_slot_list) { list_for_each_entry(slot, &pci_hotplug_slot_list, slot_list) {
slot = list_entry(tmp, struct hotplug_slot, slot_list);
if (strcmp(hotplug_slot_name(slot), name) == 0) if (strcmp(hotplug_slot_name(slot), name) == 0)
return slot; return slot;
} }
......
...@@ -321,17 +321,14 @@ static int __init init_slots(void) ...@@ -321,17 +321,14 @@ static int __init init_slots(void)
static void __exit cleanup_slots(void) static void __exit cleanup_slots(void)
{ {
struct list_head *tmp; struct slot *slot, *next;
struct list_head *next;
struct slot *slot;
/* /*
* Unregister all of our slots with the pci_hotplug subsystem. * Unregister all of our slots with the pci_hotplug subsystem.
* Memory will be freed in release_slot() callback after slot's * Memory will be freed in release_slot() callback after slot's
* lifespan is finished. * lifespan is finished.
*/ */
list_for_each_safe(tmp, next, &slot_list) { list_for_each_entry_safe(slot, next, &slot_list, slot_list) {
slot = list_entry(tmp, struct slot, slot_list);
list_del(&slot->slot_list); list_del(&slot->slot_list);
pci_hp_deregister(slot->hotplug_slot); pci_hp_deregister(slot->hotplug_slot);
} }
......
...@@ -114,11 +114,10 @@ static struct device_node *find_dlpar_node(char *drc_name, int *node_type) ...@@ -114,11 +114,10 @@ static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
*/ */
static struct slot *find_php_slot(struct device_node *dn) static struct slot *find_php_slot(struct device_node *dn)
{ {
struct list_head *tmp, *n; struct slot *slot, *next;
struct slot *slot;
list_for_each_safe(tmp, n, &rpaphp_slot_head) { list_for_each_entry_safe(slot, next, &rpaphp_slot_head,
slot = list_entry(tmp, struct slot, rpaphp_slot_list); rpaphp_slot_list) {
if (slot->dn == dn) if (slot->dn == dn)
return slot; return slot;
} }
......
...@@ -356,8 +356,7 @@ EXPORT_SYMBOL_GPL(rpaphp_add_slot); ...@@ -356,8 +356,7 @@ EXPORT_SYMBOL_GPL(rpaphp_add_slot);
static void __exit cleanup_slots(void) static void __exit cleanup_slots(void)
{ {
struct list_head *tmp, *n; struct slot *slot, *next;
struct slot *slot;
/* /*
* Unregister all of our slots with the pci_hotplug subsystem, * Unregister all of our slots with the pci_hotplug subsystem,
...@@ -365,8 +364,8 @@ static void __exit cleanup_slots(void) ...@@ -365,8 +364,8 @@ static void __exit cleanup_slots(void)
* memory will be freed in release_slot callback. * memory will be freed in release_slot callback.
*/ */
list_for_each_safe(tmp, n, &rpaphp_slot_head) { list_for_each_entry_safe(slot, next, &rpaphp_slot_head,
slot = list_entry(tmp, struct slot, rpaphp_slot_list); rpaphp_slot_list) {
list_del(&slot->rpaphp_slot_list); list_del(&slot->rpaphp_slot_list);
pci_hp_deregister(slot->hotplug_slot); pci_hp_deregister(slot->hotplug_slot);
} }
......
...@@ -201,11 +201,10 @@ int zpci_init_slot(struct zpci_dev *zdev) ...@@ -201,11 +201,10 @@ int zpci_init_slot(struct zpci_dev *zdev)
void zpci_exit_slot(struct zpci_dev *zdev) void zpci_exit_slot(struct zpci_dev *zdev)
{ {
struct list_head *tmp, *n; struct slot *slot, *next;
struct slot *slot;
list_for_each_safe(tmp, n, &s390_hotplug_slot_list) { list_for_each_entry_safe(slot, next, &s390_hotplug_slot_list,
slot = list_entry(tmp, struct slot, slot_list); slot_list) {
if (slot->zdev != zdev) if (slot->zdev != zdev)
continue; continue;
list_del(&slot->slot_list); list_del(&slot->slot_list);
......
...@@ -178,12 +178,9 @@ static int init_slots(struct controller *ctrl) ...@@ -178,12 +178,9 @@ static int init_slots(struct controller *ctrl)
void cleanup_slots(struct controller *ctrl) void cleanup_slots(struct controller *ctrl)
{ {
struct list_head *tmp; struct slot *slot, *next;
struct list_head *next;
struct slot *slot;
list_for_each_safe(tmp, next, &ctrl->slot_list) { list_for_each_entry_safe(slot, next, &ctrl->slot_list, slot_list) {
slot = list_entry(tmp, struct slot, slot_list);
list_del(&slot->slot_list); list_del(&slot->slot_list);
cancel_delayed_work(&slot->work); cancel_delayed_work(&slot->work);
destroy_workqueue(slot->wq); destroy_workqueue(slot->wq);
......
...@@ -92,6 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size) ...@@ -92,6 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
last_image = readb(pds + 21) & 0x80; last_image = readb(pds + 21) & 0x80;
length = readw(pds + 16); length = readw(pds + 16);
image += length * 512; image += length * 512;
/* Avoid iterating through memory outside the resource window */
if (image > rom + size)
break;
} while (length && !last_image); } while (length && !last_image);
/* never return a size larger than the PCI resource window */ /* never return a size larger than the PCI resource window */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment