Commit b6a31950 authored by Roel Kluin's avatar Roel Kluin Committed by Jean Delvare

i2c: Test off by one in {piix4,vt596}_transaction()

With `while (timeout++ < MAX_TIMEOUT)' timeout reaches MAX_TIMEOUT + 1
after the loop. This is probably unlikely to produce a problem.
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarJean Delvare <khali@linux-fr.org>
parent 0b2c3688
...@@ -324,12 +324,12 @@ static int piix4_transaction(void) ...@@ -324,12 +324,12 @@ static int piix4_transaction(void)
else else
msleep(1); msleep(1);
while ((timeout++ < MAX_TIMEOUT) && while ((++timeout < MAX_TIMEOUT) &&
((temp = inb_p(SMBHSTSTS)) & 0x01)) ((temp = inb_p(SMBHSTSTS)) & 0x01))
msleep(1); msleep(1);
/* If the SMBus is still busy, we give up */ /* If the SMBus is still busy, we give up */
if (timeout >= MAX_TIMEOUT) { if (timeout == MAX_TIMEOUT) {
dev_err(&piix4_adapter.dev, "SMBus Timeout!\n"); dev_err(&piix4_adapter.dev, "SMBus Timeout!\n");
result = -ETIMEDOUT; result = -ETIMEDOUT;
} }
......
...@@ -165,10 +165,10 @@ static int vt596_transaction(u8 size) ...@@ -165,10 +165,10 @@ static int vt596_transaction(u8 size)
do { do {
msleep(1); msleep(1);
temp = inb_p(SMBHSTSTS); temp = inb_p(SMBHSTSTS);
} while ((temp & 0x01) && (timeout++ < MAX_TIMEOUT)); } while ((temp & 0x01) && (++timeout < MAX_TIMEOUT));
/* If the SMBus is still busy, we give up */ /* If the SMBus is still busy, we give up */
if (timeout >= MAX_TIMEOUT) { if (timeout == MAX_TIMEOUT) {
result = -ETIMEDOUT; result = -ETIMEDOUT;
dev_err(&vt596_adapter.dev, "SMBus timeout!\n"); dev_err(&vt596_adapter.dev, "SMBus timeout!\n");
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment