Commit c792eba1 authored by Logan Gunthorpe's avatar Logan Gunthorpe Committed by Jon Mason

ntb_tool: Fix infinite loop bug when writing spad/peer_spad file

If you tried to write two spads in one line, as per the example:

root@peer# echo '0 0x01010101 1 0x7f7f7f7f' > $DBG_DIR/peer_spad

then the CPU would freeze in an infinite loop.

This wasn't immediately obvious but 'pos' was not incrementing the
buffer, so after reading the second pair of values, 'pos' would once
again be 3 and it would re-read the second pair of values ad infinitum.
Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
Acked-by: default avatarAllen Hubbe <Allen.Hubbe@emc.com>
Signed-off-by: default avatarJon Mason <jdmason@kudzu.us>
parent 523d939e
...@@ -268,7 +268,7 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc, ...@@ -268,7 +268,7 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc,
{ {
int spad_idx; int spad_idx;
u32 spad_val; u32 spad_val;
char *buf; char *buf, *buf_ptr;
int pos, n; int pos, n;
ssize_t rc; ssize_t rc;
...@@ -288,14 +288,15 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc, ...@@ -288,14 +288,15 @@ static ssize_t tool_spadfn_write(struct tool_ctx *tc,
} }
buf[size] = 0; buf[size] = 0;
buf_ptr = buf;
n = sscanf(buf, "%d %i%n", &spad_idx, &spad_val, &pos); n = sscanf(buf_ptr, "%d %i%n", &spad_idx, &spad_val, &pos);
while (n == 2) { while (n == 2) {
buf_ptr += pos;
rc = spad_write_fn(tc->ntb, spad_idx, spad_val); rc = spad_write_fn(tc->ntb, spad_idx, spad_val);
if (rc) if (rc)
break; break;
n = sscanf(buf + pos, "%d %i%n", &spad_idx, &spad_val, &pos); n = sscanf(buf_ptr, "%d %i%n", &spad_idx, &spad_val, &pos);
} }
if (n < 0) if (n < 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment