From b4bd6554937ca5c13786b6725e122839f5ebe4f7 Mon Sep 17 00:00:00 2001 From: Marcel Ziswiler Date: Wed, 18 Nov 2015 15:05:06 +0100 Subject: pci: fix address range check in __pci_hose_phys_to_bus() The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages: Apalis TK1 # tftpboot $loadaddr test_file Using e1000#0 device TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'. Load address: 0x80408000 Loading: pci_hose_phys_to_bus: invalid physical address This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys(). Reported-by: Ivan Mercier Signed-off-by: Marcel Ziswiler Reviewed-by: Bin Meng Reviewed-by: Stephen Warren Acked-by: Simon Glass --- drivers/pci/pci_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pci_common.c b/drivers/pci/pci_common.c index a64792f988..2a149022e2 100644 --- a/drivers/pci/pci_common.c +++ b/drivers/pci/pci_common.c @@ -268,7 +268,7 @@ int __pci_hose_phys_to_bus(struct pci_controller *hose, bus_addr = phys_addr - res->phys_start + res->bus_start; if (bus_addr >= res->bus_start && - bus_addr < res->bus_start + res->size) { + (bus_addr - res->bus_start) < res->size) { *ba = bus_addr; return 0; } -- cgit v1.2.3