Commit 4f03ffcd authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

serial: icom: move array overflow checks earlier

This code does an annoying thing where it writes to the array and then
checks later for array overflows.  I don't know if it's actually
possible to overflow but let's check before using the array index.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1b2a405b
...@@ -297,25 +297,25 @@ static void stop_processor(struct icom_port *icom_port) ...@@ -297,25 +297,25 @@ static void stop_processor(struct icom_port *icom_port)
spin_lock_irqsave(&icom_lock, flags); spin_lock_irqsave(&icom_lock, flags);
port = icom_port->port; port = icom_port->port;
if (port >= ARRAY_SIZE(stop_proc)) {
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n");
goto unlock;
}
if (port == 0 || port == 1) if (port == 0 || port == 1)
stop_proc[port].global_control_reg = &icom_port->global_reg->control; stop_proc[port].global_control_reg = &icom_port->global_reg->control;
else else
stop_proc[port].global_control_reg = &icom_port->global_reg->control_2; stop_proc[port].global_control_reg = &icom_port->global_reg->control_2;
temp = readl(stop_proc[port].global_control_reg);
temp = (temp & ~start_proc[port].processor_id) | stop_proc[port].processor_id;
writel(temp, stop_proc[port].global_control_reg);
if (port < 4) { /* write flush */
temp = readl(stop_proc[port].global_control_reg); readl(stop_proc[port].global_control_reg);
temp =
(temp & ~start_proc[port].processor_id) | stop_proc[port].processor_id;
writel(temp, stop_proc[port].global_control_reg);
/* write flush */
readl(stop_proc[port].global_control_reg);
} else {
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n");
}
unlock:
spin_unlock_irqrestore(&icom_lock, flags); spin_unlock_irqrestore(&icom_lock, flags);
} }
...@@ -328,23 +328,25 @@ static void start_processor(struct icom_port *icom_port) ...@@ -328,23 +328,25 @@ static void start_processor(struct icom_port *icom_port)
spin_lock_irqsave(&icom_lock, flags); spin_lock_irqsave(&icom_lock, flags);
port = icom_port->port; port = icom_port->port;
if (port >= ARRAY_SIZE(start_proc)) {
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n");
goto unlock;
}
if (port == 0 || port == 1) if (port == 0 || port == 1)
start_proc[port].global_control_reg = &icom_port->global_reg->control; start_proc[port].global_control_reg = &icom_port->global_reg->control;
else else
start_proc[port].global_control_reg = &icom_port->global_reg->control_2; start_proc[port].global_control_reg = &icom_port->global_reg->control_2;
if (port < 4) {
temp = readl(start_proc[port].global_control_reg);
temp =
(temp & ~stop_proc[port].processor_id) | start_proc[port].processor_id;
writel(temp, start_proc[port].global_control_reg);
/* write flush */ temp = readl(start_proc[port].global_control_reg);
readl(start_proc[port].global_control_reg); temp = (temp & ~stop_proc[port].processor_id) | start_proc[port].processor_id;
} else { writel(temp, start_proc[port].global_control_reg);
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n"); /* write flush */
} readl(start_proc[port].global_control_reg);
unlock:
spin_unlock_irqrestore(&icom_lock, flags); spin_unlock_irqrestore(&icom_lock, flags);
} }
...@@ -557,6 +559,12 @@ static int startup(struct icom_port *icom_port) ...@@ -557,6 +559,12 @@ static int startup(struct icom_port *icom_port)
*/ */
spin_lock_irqsave(&icom_lock, flags); spin_lock_irqsave(&icom_lock, flags);
port = icom_port->port; port = icom_port->port;
if (port >= ARRAY_SIZE(int_mask_tbl)) {
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n");
goto unlock;
}
if (port == 0 || port == 1) if (port == 0 || port == 1)
int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask; int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask;
else else
...@@ -566,17 +574,14 @@ static int startup(struct icom_port *icom_port) ...@@ -566,17 +574,14 @@ static int startup(struct icom_port *icom_port)
writew(0x00FF, icom_port->int_reg); writew(0x00FF, icom_port->int_reg);
else else
writew(0x3F00, icom_port->int_reg); writew(0x3F00, icom_port->int_reg);
if (port < 4) {
temp = readl(int_mask_tbl[port].global_int_mask);
writel(temp & ~int_mask_tbl[port].processor_id, int_mask_tbl[port].global_int_mask);
/* write flush */ temp = readl(int_mask_tbl[port].global_int_mask);
readl(int_mask_tbl[port].global_int_mask); writel(temp & ~int_mask_tbl[port].processor_id, int_mask_tbl[port].global_int_mask);
} else {
dev_err(&icom_port->adapter->pci_dev->dev, /* write flush */
"Invalid port assignment\n"); readl(int_mask_tbl[port].global_int_mask);
}
unlock:
spin_unlock_irqrestore(&icom_lock, flags); spin_unlock_irqrestore(&icom_lock, flags);
return 0; return 0;
} }
...@@ -595,21 +600,23 @@ static void shutdown(struct icom_port *icom_port) ...@@ -595,21 +600,23 @@ static void shutdown(struct icom_port *icom_port)
* disable all interrupts * disable all interrupts
*/ */
port = icom_port->port; port = icom_port->port;
if (port >= ARRAY_SIZE(int_mask_tbl)) {
dev_err(&icom_port->adapter->pci_dev->dev,
"Invalid port assignment\n");
goto unlock;
}
if (port == 0 || port == 1) if (port == 0 || port == 1)
int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask; int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask;
else else
int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask_2; int_mask_tbl[port].global_int_mask = &icom_port->global_reg->int_mask_2;
if (port < 4) { temp = readl(int_mask_tbl[port].global_int_mask);
temp = readl(int_mask_tbl[port].global_int_mask); writel(temp | int_mask_tbl[port].processor_id, int_mask_tbl[port].global_int_mask);
writel(temp | int_mask_tbl[port].processor_id, int_mask_tbl[port].global_int_mask);
/* write flush */ /* write flush */
readl(int_mask_tbl[port].global_int_mask); readl(int_mask_tbl[port].global_int_mask);
} else {
dev_err(&icom_port->adapter->pci_dev->dev, unlock:
"Invalid port assignment\n");
}
spin_unlock_irqrestore(&icom_lock, flags); spin_unlock_irqrestore(&icom_lock, flags);
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment