summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2009-07-04 15:31:47 +0400
committerDavid S. Miller <davem@davemloft.net>2009-07-06 05:03:30 +0400
commit3942453948015228d6b1ae9835a6f6ca3e842aaa (patch)
treed409b9a94a6e8305e43c11d535897f4ccf712ea3 /drivers
parent4c3dd308adbda61f2ab46a14a0adcca8e1338ea5 (diff)
downloadlinux-3942453948015228d6b1ae9835a6f6ca3e842aaa.tar.xz
drivers/net/smsc911x.c: Fix resource size off by 1 error
The call resource_size(res) returns res->end - res->start + 1 and thus the second change is semantics-preserving. res_size is then used as the second argument of a call to request_mem_region, and the memory allocated by this call appears to be the same as what is released in the two calls to release_mem_region. So the size argument for those calls should be resource_size(size) as well. Alternatively, in the second call to release_mem_region, the second argument could be res_size, as that variable has already been initialized at the point of this call. The problem was found using the following semantic patch: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ struct resource *res; @@ - (res->end - res->start) + 1 + resource_size(res) @@ struct resource *res; @@ - res->end - res->start + BAD(resource_size(res)) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/smsc911x.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index b60639bd181b..66067f9d91c0 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1938,7 +1938,7 @@ static int __devexit smsc911x_drv_remove(struct platform_device *pdev)
if (!res)
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- release_mem_region(res->start, res->end - res->start);
+ release_mem_region(res->start, resource_size(res));
iounmap(pdata->ioaddr);
@@ -1976,7 +1976,7 @@ static int __devinit smsc911x_drv_probe(struct platform_device *pdev)
retval = -ENODEV;
goto out_0;
}
- res_size = res->end - res->start + 1;
+ res_size = resource_size(res);
irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
if (!irq_res) {
@@ -2104,7 +2104,7 @@ out_unmap_io_3:
out_free_netdev_2:
free_netdev(dev);
out_release_io_1:
- release_mem_region(res->start, res->end - res->start);
+ release_mem_region(res->start, resource_size(res));
out_0:
return retval;
}