From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ivan Mercier Date: Wed, 18 Nov 2015 15:53:01 +0100 Subject: [U-Boot] [PATCH] pci: fix address range check in __pci_hose_phys_to_bus() In-Reply-To: References: <1447855506-14584-1-git-send-email-marcel.ziswiler@toradex.com> Message-ID: <564C90CD.5060807@nexvision.fr> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Well done Marcel! I didn't have much more time to investigate on it. OK with nvidia jetson TK1 with i210 AND RTL8169. On 18/11/2015 15:19, Bin Meng wrote: > On Wed, Nov 18, 2015 at 10:05 PM, Marcel Ziswiler > wrote: >> The address range check may overflow if the memory region is located at >> the top of the 32-bit address space. This can e.g. be seen on TK1 if >> using the E1000 gigabit Ethernet driver where start and size are both >> 0x80000000 leading to the following messages: >> >> Apalis TK1 # tftpboot $loadaddr test_file >> Using e1000#0 device >> TFTP from server 192.168.10.1; our IP address is 192.168.10.2 >> Filename 'test_file'. >> Load address: 0x80408000 >> Loading: pci_hose_phys_to_bus: invalid physical address >> >> This patch fixes this by changing the order of the addition vs. >> subtraction in the range check just like already done in >> __pci_hose_bus_to_phys(). >> >> Reported-by: Ivan Mercier >> Signed-off-by: Marcel Ziswiler >> --- >> >> drivers/pci/pci_common.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/pci/pci_common.c b/drivers/pci/pci_common.c >> index a64792f..2a14902 100644 >> --- a/drivers/pci/pci_common.c >> +++ b/drivers/pci/pci_common.c >> @@ -268,7 +268,7 @@ int __pci_hose_phys_to_bus(struct pci_controller *hose, >> bus_addr = phys_addr - res->phys_start + res->bus_start; >> >> if (bus_addr >= res->bus_start && >> - bus_addr < res->bus_start + res->size) { >> + (bus_addr - res->bus_start) < res->size) { >> *ba = bus_addr; >> return 0; >> } >> -- > Reviewed-by: Bin Meng >