[OPERA] Potential bug in /arch/sparc/prom/memory.c & /arch/sparc64/prom/memory.c

[OPERA] Potential bug in /arch/sparc/prom/memory.c & /arch/sparc64/prom/memory.c

[Zhenmin Li]

We ran our bug detection tool upon Linux 2.6.6, and found some potential
errors. We would sincerely appreciate your help if anyone can confirm
whether they are bugs or not.

Linux 2.6.6, /arch/sparc/prom/memory.c, Line 153-160

153    for(iter=0; iter<num_regs; iter++) {
154            prom_prom_taken[iter].start_adr =
155                    (char *) prom_reg_memlist[iter].phys_addr;
156            prom_prom_taken[iter].num_bytes =
157                    (unsigned long) prom_reg_memlist[iter].reg_size;
158            prom_prom_taken[iter].theres_more =
!159                    &prom_phys_total[iter+1];
160    }

May be changeg to:

153    for(iter=0; iter<num_regs; iter++) {
154            prom_prom_taken[iter].start_adr =
155                    (char *) prom_reg_memlist[iter].phys_addr;
156            prom_prom_taken[iter].num_bytes =
157                    (unsigned long) prom_reg_memlist[iter].reg_size;
158            prom_prom_taken[iter].theres_more =
!159                    & prom_prom_taken[iter+1];
160    }


The same bug is in /arch/sparc64/prom/memory.c, Line 111-118.


Thanks a lot,
OPERA Research Group
University of Illinois at Urbana-Champaign

Re: [OPERA] Potential bug in /arch/sparc/prom/memory.c & /arch/sparc64/prom/memory.c

[David S. Miller]

On Wed, 19 May 2004 21:45:03 -0500
"Zhenmin Li" <zli4@cs.uiuc.edu> wrote:

> 158            prom_prom_taken[iter].theres_more =
> !159                    &prom_phys_total[iter+1];
> 158            prom_prom_taken[iter].theres_more =
> !159                    & prom_prom_taken[iter+1];

It's a bug, but luckily harmless as we never actually
walk the link of this table's elements, and in most
other places we only test it against NULL :-)

But I've added the fix to my tree(s), thanks a lot!