mtd: nand: r852: correct write_buf loop bounds

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff
Commit:     ab7f6fcec33a01279d2abeaf1c4ccdfa8a5d93ff
Parent:     abb9cf78e80ab4407c3efb0950f08e6941bc7e73
Author:     Brian Norris <computersforpeace at gmail.com>
AuthorDate: Tue May 20 22:47:26 2014 -0700
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Wed May 28 00:05:26 2014 -0700

    mtd: nand: r852: correct write_buf loop bounds
    
    The two loops in r852_write_buf() are designed to handle 4-byte-aligned
    and then 1-byte-aligned portions, respectively. However, there are two
    issues:
    
    (1) The first loop will only terminate if 'len' is a multiple of 4
    (2) The second loop will never terminate if it runs at least once
    
    Rewrite these loops as they were probably intended. Compile tested only.
    
    Issues pointed out by Coverity Scan.
    
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
    Cc: Maxim Levitsky <maximlevitsky at gmail.com>
---
 drivers/mtd/nand/r852.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 325930d..baea83f 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -245,7 +245,7 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
 	}
 
 	/* write DWORD chinks - faster */
-	while (len) {
+	while (len >= 4) {
 		reg = buf[0] | buf[1] << 8 | buf[2] << 16 | buf[3] << 24;
 		r852_write_reg_dword(dev, R852_DATALINE, reg);
 		buf += 4;
@@ -254,8 +254,10 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
 	}
 
 	/* write rest */
-	while (len)
+	while (len > 0) {
 		r852_write_reg(dev, R852_DATALINE, *buf++);
+		len--;
+	}
 }
 
 /*