Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752752AbcCWVoI (ORCPT ); Wed, 23 Mar 2016 17:44:08 -0400 Received: from hauke-m.de ([5.39.93.123]:42579 "EHLO hauke-m.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750857AbcCWVoG (ORCPT ); Wed, 23 Mar 2016 17:44:06 -0400 Subject: Re: [PATCH v2] drivers/firmware/broadcom/bcm47xx_nvram.c: fix incorrect __ioread32_copy To: Aaro Koskinen , Stephen Boyd , =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= , Andrew Morton References: <1458083178-8207-1-git-send-email-aaro.koskinen@iki.fi> Cc: linux-mips@linux-mips.org, linux-kernel@vger.kernel.org From: Hauke Mehrtens X-Enigmail-Draft-Status: N1110 Message-ID: <56F30E1F.5020108@hauke-m.de> Date: Wed, 23 Mar 2016 22:43:59 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Icedove/38.7.0 MIME-Version: 1.0 In-Reply-To: <1458083178-8207-1-git-send-email-aaro.koskinen@iki.fi> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2270 Lines: 54 On 03/16/2016 12:06 AM, Aaro Koskinen wrote: > Commit 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use > __ioread32_copy() instead of open-coding") switched to use a generic copy > function, but failed to notice that the header pointer is updated between > the two copies, resulting in bogus data being copied in the latter one. > Fix by keeping the old header pointer. > > The patch fixes totally broken networking on WRT54GL router (both LAN > and WLAN interfaces fail to probe). > > Fixes: 1f330c327900 ("drivers/firmware/broadcom/bcm47xx_nvram.c: use __ioread32_copy() instead of open-coding") > Signed-off-by: Aaro Koskinen > --- > > v2: Avoid using the device memory after the first copy when > checking the nvram length, suggested by Stephen Boyd. > > v1: http://marc.info/?t=145807850800003&r=1&w=2 > > drivers/firmware/broadcom/bcm47xx_nvram.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/drivers/firmware/broadcom/bcm47xx_nvram.c b/drivers/firmware/broadcom/bcm47xx_nvram.c > index 0c2f0a6..0b631e5 100644 > --- a/drivers/firmware/broadcom/bcm47xx_nvram.c > +++ b/drivers/firmware/broadcom/bcm47xx_nvram.c > @@ -94,15 +94,14 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim) > > found: > __ioread32_copy(nvram_buf, header, sizeof(*header) / 4); > - header = (struct nvram_header *)nvram_buf; > - nvram_len = header->len; > + nvram_len = ((struct nvram_header *)(nvram_buf))->len; I do not understand why this change is needed? Doesn't the old code do exactly the same as the new one? The old code updated the header pointer and then accesses a member, the new one directly accesses this member without updating this pointer. I assume, I am missing something. ;-) > if (nvram_len > size) { > pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n"); > nvram_len = size; > } > if (nvram_len >= NVRAM_SPACE) { > pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n", > - header->len, NVRAM_SPACE - 1); > + nvram_len, NVRAM_SPACE - 1); > nvram_len = NVRAM_SPACE - 1; > } > /* proceed reading data after header */ >