summaryrefslogtreecommitdiff
path: root/drivers/pci
diff options
context:
space:
mode:
authorMarcel Ziswiler <marcel.ziswiler@toradex.com>2015-11-18 15:05:06 +0100
committerTom Rini <trini@konsulko.com>2015-11-23 11:01:52 -0500
commitb4bd6554937ca5c13786b6725e122839f5ebe4f7 (patch)
treef85f3113264df3d4819e199279ffcd62ffd9bf1a /drivers/pci
parentcfdaf4caa250a4bc3de41f47147715e8a81be5a2 (diff)
downloadu-boot-imx-b4bd6554937ca5c13786b6725e122839f5ebe4f7.zip
u-boot-imx-b4bd6554937ca5c13786b6725e122839f5ebe4f7.tar.gz
u-boot-imx-b4bd6554937ca5c13786b6725e122839f5ebe4f7.tar.bz2
pci: fix address range check in __pci_hose_phys_to_bus()
The address range check may overflow if the memory region is located at the top of the 32-bit address space. This can e.g. be seen on TK1 if using the E1000 gigabit Ethernet driver where start and size are both 0x80000000 leading to the following messages: Apalis TK1 # tftpboot $loadaddr test_file Using e1000#0 device TFTP from server 192.168.10.1; our IP address is 192.168.10.2 Filename 'test_file'. Load address: 0x80408000 Loading: pci_hose_phys_to_bus: invalid physical address This patch fixes this by changing the order of the addition vs. subtraction in the range check just like already done in __pci_hose_bus_to_phys(). Reported-by: Ivan Mercier <ivan.mercier@nexvision.fr> Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Stephen Warren <swarren@nvidia.com> Acked-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'drivers/pci')
-rw-r--r--drivers/pci/pci_common.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/pci/pci_common.c b/drivers/pci/pci_common.c
index a64792f..2a14902 100644
--- a/drivers/pci/pci_common.c
+++ b/drivers/pci/pci_common.c
@@ -268,7 +268,7 @@ int __pci_hose_phys_to_bus(struct pci_controller *hose,
bus_addr = phys_addr - res->phys_start + res->bus_start;
if (bus_addr >= res->bus_start &&
- bus_addr < res->bus_start + res->size) {
+ (bus_addr - res->bus_start) < res->size) {
*ba = bus_addr;
return 0;
}