Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 3942453948015228d6b1ae9835a6f6ca3e842aaa

Authored by Julia Lawall
Committed by David S. Miller
1 parent 4c3dd308ad
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

drivers/net/smsc911x.c: Fix resource size off by 1 error 

The call resource_size(res) returns res->end - res->start + 1 and thus the
second change is semantics-preserving.  res_size is then used as the second
argument of a call to request_mem_region, and the memory allocated by this
call appears to be the same as what is released in the two calls to
release_mem_region.  So the size argument for those calls should be
resource_size(size) as well.  Alternatively, in the second call to
release_mem_region, the second argument could be res_size, as that variable
has already been initialized at the point of this call.

The problem was found using the following semantic patch:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
struct resource *res;
@@

- (res->end - res->start) + 1
+ resource_size(res)

@@
struct resource *res;
@@

- res->end - res->start
+ BAD(resource_size(res))
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 3 additions and 3 deletions Side-by-side Diff

drivers/net/smsc911x.c
Diff comments   View file @ 3942453
... ... @@ -1938,7 +1938,7 @@
1938 1938 if (!res)
1939 1939 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
1940 1940  
1941   - release_mem_region(res->start, res->end - res->start);
  1941 + release_mem_region(res->start, resource_size(res));
1942 1942  
1943 1943 iounmap(pdata->ioaddr);
1944 1944  
... ... @@ -1976,7 +1976,7 @@
1976 1976 retval = -ENODEV;
1977 1977 goto out_0;
1978 1978 }
1979   - res_size = res->end - res->start + 1;
  1979 + res_size = resource_size(res);
1980 1980  
1981 1981 irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
1982 1982 if (!irq_res) {
... ... @@ -2104,7 +2104,7 @@
2104 2104 out_free_netdev_2:
2105 2105 free_netdev(dev);
2106 2106 out_release_io_1:
2107   - release_mem_region(res->start, res->end - res->start);
  2107 + release_mem_region(res->start, resource_size(res));
2108 2108 out_0:
2109 2109 return retval;
2110 2110 }