2007-11-07 18:34:38

by Roel Kluin

Subject: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

If count reaches zero, the loop ends, but the postfix decrement subtracts it.
so, testing for 'count == 0' will not work.

Signed-off-by: Roel Kluin <[email protected]>
---
diff --git a/sound/oss/trident.c b/sound/oss/trident.c
index 96adc47..94b5fb4 100644
--- a/sound/oss/trident.c
+++ b/sound/oss/trident.c
@@ -2939,7 +2939,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)

data |= (mask | (reg & AC97_REG_ADDR));

- if (count == 0) {
+ if (count == -1) {
printk(KERN_ERR "trident: AC97 CODEC write timed out.\n");
spin_unlock_irqrestore(&card->lock, flags);
return;
@@ -2999,7 +2999,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
} while (count--);
spin_unlock_irqrestore(&card->lock, flags);

- if (count == 0) {
+ if (count == -1) {
printk(KERN_ERR "trident: AC97 CODEC read timed out.\n");
data = 0;
}

2007-11-07 18:44:15

by Ray Lee

Subject: Re: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

On Nov 7, 2007 10:34 AM, Roel Kluin <[email protected]> wrote:
> If count reaches zero, the loop ends, but the postfix decrement subtracts it.
> so, testing for 'count == 0' will not work.
>
> Signed-off-by: Roel Kluin <[email protected]>
> ---
> diff --git a/sound/oss/trident.c b/sound/oss/trident.c
> index 96adc47..94b5fb4 100644
> --- a/sound/oss/trident.c
> +++ b/sound/oss/trident.c
> @@ -2939,7 +2939,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
>
> data |= (mask | (reg & AC97_REG_ADDR));
>
> - if (count == 0) {
> + if (count == -1) {
> printk(KERN_ERR "trident: AC97 CODEC write timed out.\n");
> spin_unlock_irqrestore(&card->lock, flags);
> return;
> @@ -2999,7 +2999,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
> } while (count--);
> spin_unlock_irqrestore(&card->lock, flags);
>
> - if (count == 0) {
> + if (count == -1) {
> printk(KERN_ERR "trident: AC97 CODEC read timed out.\n");
> data = 0;
> }

You didn't test this: count is unsigned. Change the loop condition to
be --count instead.

Ray

2007-11-07 18:50:33

by Roel Kluin

Subject: Re: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

Ray Lee wrote:
> On Nov 7, 2007 10:34 AM, Roel Kluin <[email protected]> wrote:
>> If count reaches zero, the loop ends, but the postfix decrement subtracts it.
>> so, testing for 'count == 0' will not work.
>>
>> Signed-off-by: Roel Kluin <[email protected]>
>> ---
>> diff --git a/sound/oss/trident.c b/sound/oss/trident.c
>> index 96adc47..94b5fb4 100644
>> --- a/sound/oss/trident.c
>> +++ b/sound/oss/trident.c
>> @@ -2939,7 +2939,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
>>
>> data |= (mask | (reg & AC97_REG_ADDR));
>>
>> - if (count == 0) {
>> + if (count == -1) {
>> printk(KERN_ERR "trident: AC97 CODEC write timed out.\n");
>> spin_unlock_irqrestore(&card->lock, flags);
>> return;
>> @@ -2999,7 +2999,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
>> } while (count--);
>> spin_unlock_irqrestore(&card->lock, flags);
>>
>> - if (count == 0) {
>> + if (count == -1) {
>> printk(KERN_ERR "trident: AC97 CODEC read timed out.\n");
>> data = 0;
>> }
>
> You didn't test this: count is unsigned. Change the loop condition to
> be --count instead.
>
> Ray

Yep, you're right, here:
--
If count reaches zero, the loop ends, but the postfix decrement still subtracts:
testing for 'count == 0' will not work.

Signed-off-by: Roel Kluin <[email protected]>
---
diff --git a/sound/oss/trident.c b/sound/oss/trident.c
index 96adc47..6959ee1 100644
--- a/sound/oss/trident.c
+++ b/sound/oss/trident.c
@@ -2935,7 +2935,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
do {
if ((inw(TRID_REG(card, address)) & busy) == 0)
break;
- } while (count--);
+ } while (--count);

data |= (mask | (reg & AC97_REG_ADDR));

@@ -2996,7 +2996,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
data = inl(TRID_REG(card, address));
if ((data & busy) == 0)
break;
- } while (count--);
+ } while (--count);
spin_unlock_irqrestore(&card->lock, flags);

if (count == 0) {

2007-11-07 19:04:51

by Ray Lee

Subject: Re: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

On Nov 7, 2007 10:50 AM, Roel Kluin <[email protected]> wrote:
> If count reaches zero, the loop ends, but the postfix decrement still subtracts:
> testing for 'count == 0' will not work.
>
> Signed-off-by: Roel Kluin <[email protected]>
> ---
> diff --git a/sound/oss/trident.c b/sound/oss/trident.c
> index 96adc47..6959ee1 100644
> --- a/sound/oss/trident.c
> +++ b/sound/oss/trident.c
> @@ -2935,7 +2935,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
> do {
> if ((inw(TRID_REG(card, address)) & busy) == 0)
> break;
> - } while (count--);
> + } while (--count);
>
> data |= (mask | (reg & AC97_REG_ADDR));
>
> @@ -2996,7 +2996,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
> data = inl(TRID_REG(card, address));
> if ((data & busy) == 0)
> break;
> - } while (count--);
> + } while (--count);
>
> spin_unlock_irqrestore(&card->lock, flags);
>
> if (count == 0) {
>

Thanks, much better. In the future, please also CC: the appropriate
maintainers, or Andrew Morton if you're at a loss...

Reviewed-by: Ray Lee <[email protected]>

2007-11-08 06:06:43

by Muli Ben-Yehuda

Subject: Re: [PATCH] fix incorrect test in trident_ac97_set(); sound/oss/trident.c

On Wed, Nov 07, 2007 at 11:04:41AM -0800, Ray Lee wrote:

> On Nov 7, 2007 10:50 AM, Roel Kluin <[email protected]> wrote:

> > If count reaches zero, the loop ends, but the postfix decrement
> > still subtracts: testing for 'count == 0' will not work.
> >
> > Signed-off-by: Roel Kluin <[email protected]>
> > ---
> > diff --git a/sound/oss/trident.c b/sound/oss/trident.c
> > index 96adc47..6959ee1 100644
> > --- a/sound/oss/trident.c
> > +++ b/sound/oss/trident.c
> > @@ -2935,7 +2935,7 @@ trident_ac97_set(struct ac97_codec *codec, u8 reg, u16 val)
> > do {
> > if ((inw(TRID_REG(card, address)) & busy) == 0)
> > break;
> > - } while (count--);
> > + } while (--count);
> >
> > data |= (mask | (reg & AC97_REG_ADDR));
> >
> > @@ -2996,7 +2996,7 @@ trident_ac97_get(struct ac97_codec *codec, u8 reg)
> > data = inl(TRID_REG(card, address));
> > if ((data & busy) == 0)
> > break;
> > - } while (count--);
> > + } while (--count);
> >
> > spin_unlock_irqrestore(&card->lock, flags);
> >
> > if (count == 0) {
> >
>
> Thanks, much better. In the future, please also CC: the appropriate
> maintainers, or Andrew Morton if you're at a loss...

Indeed.

> Reviewed-by: Ray Lee <[email protected]>

Acked-by: Muli Ben-Yehuda <[email protected]>

Andrew, can you please push to Linus?

Thanks,
Muli