From patchwork Wed Nov 18 14:05:06 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marcel Ziswiler X-Patchwork-Id: 546025 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from theia.denx.de (theia.denx.de [85.214.87.163]) by ozlabs.org (Postfix) with ESMTP id 9B282141435 for ; Thu, 19 Nov 2015 01:28:58 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id F2BE74B909; Wed, 18 Nov 2015 15:28:25 +0100 (CET) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0OBgUP9rNQXq; Wed, 18 Nov 2015 15:28:25 +0100 (CET) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id CAE094B905; Wed, 18 Nov 2015 15:27:59 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 0D6094B818 for ; Wed, 18 Nov 2015 15:10:48 +0100 (CET) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4oUG_FUyRQiR for ; Wed, 18 Nov 2015 15:10:47 +0100 (CET) X-Greylist: delayed 316 seconds by postgrey-1.34 at theia; Wed, 18 Nov 2015 15:10:43 CET X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from mout.perfora.net (mout.perfora.net [74.208.4.197]) by theia.denx.de (Postfix) with ESMTPS id 684B04B817 for ; Wed, 18 Nov 2015 15:10:43 +0100 (CET) Received: from localhost.localdomain ([46.140.72.82]) by mrelay.perfora.net (mreueus001) with ESMTPA (Nemesis) id 0MQ4iz-1a4IPp0UJ1-005NDa; Wed, 18 Nov 2015 15:05:14 +0100 From: Marcel Ziswiler To: Marcel Ziswiler Date: Wed, 18 Nov 2015 15:05:06 +0100 Message-Id: <1447855506-14584-1-git-send-email-marcel.ziswiler@toradex.com> X-Mailer: git-send-email 2.5.0 X-Provags-ID: V03:K0:FKP14boKL1WdUP0rwV3PG77txS4Dl6ZIzuL6bRT6jyasj8zfd7G N2VnmlXhH6+8EJtG4C8AbPXt0MQbIff9hFZV3cEvz0CHtxP7iID2Znq8f8bCnl16UPpjnYE IQvcv8wKIgZEpWz7s2IWW8RfTcpQi7V+vJec/dR/RYUNW21OXv0DblfExw/HYB64RZFYT4W aMv0IF2SQQ6rlqf1ChlCw== X-UI-Out-Filterresults: notjunk:1; V01:K0:D/UZq+c/hwU=:CFtltSHigBD28tYfn0pyBM 08TzKkTEKOnp+hYqrlb3y7ITcb5oAjCM2AP/IBIDN/YK/ueO0a4tTaxzUfiYB8vvef7DypZgc qGNB4l/f600VGWBAUBJy5bp86tbYJ84qOTcIBwx+4kz4Un6+vzMOGeDS3hjLvrSMW0z0RZtv2 Lcqev3nLNqjche2pJQcAv+VTuQ3KNDQHo7qqEHDPHrppzjq9QkFOg8EKkhhm2hSfQagY9qNrq bPU2ueAwqEne8bFOyf3cVxXyOES9xgcyH1jpY3FLS/xVYehxsC5+eGJ1ee1KB0Yaz3Z58LBjR rJfb3dMHfvVtPGL3NFHMGalStq2QTyjfhBJp/gMC5Vqx9IaiymlPc+8ERKcgRjQ96MSrcyV7H g7S6Kl1MVR9JwWDRDWG2O2y4XumWKV2opi1STTlST6eoun8iyVgXrHm9gCqY9VC5+XKGAcm8g FtV89dhI76eF4LjxGwcTpt76YgNvQXfJAeUoNSSC29/OSIAGS8sDjTEfCqirnHeKp0K1n9C86 76v1dNn6hB+hOxKX/clLqYVs6/yrCqllYqCXb2sppoymqHs6t1EPAac+pVpVOwobMzexiBz+P Bm9facc/SdoMQBagk2V6SATPL3GfkNVpUdD2CK2rvFLeRkOHC8czNFQYHnUfmbxGS1i9c+S9L H4kxZ4lIrhAfWf49GCukg7ZjSgG/Fs08gD1sXOFfPvkB7t2Uhtp3hrHJoNOq/FWIGhcA= X-Mailman-Approved-At: Wed, 18 Nov 2015 15:27:47 +0100 Cc: Cheng Gu , Marcel Ziswiler , Ivan Mercier , u-boot@lists.denx.de Subject: [U-Boot] [PATCH] pci: fix address range check in __pci_hose_phys_to_bus() X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.15 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages: Apalis TK1 # tftpboot $loadaddr test_file Using e1000#0 device TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'. Load address: 0x80408000 Loading: pci_hose_phys_to_bus: invalid physical address This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys(). Reported-by: Ivan Mercier Signed-off-by: Marcel Ziswiler Reviewed-by: Bin Meng Reviewed-by: Stephen Warren Acked-by: Simon Glass --- drivers/pci/pci_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pci_common.c b/drivers/pci/pci_common.c index a64792f..2a14902 100644 --- a/drivers/pci/pci_common.c +++ b/drivers/pci/pci_common.c @@ -268,7 +268,7 @@ int __pci_hose_phys_to_bus(struct pci_controller *hose, bus_addr = phys_addr - res->phys_start + res->bus_start; if (bus_addr >= res->bus_start && - bus_addr < res->bus_start + res->size) { + (bus_addr - res->bus_start) < res->size) { *ba = bus_addr; return 0; }