Commit 62ff2ecf authored by Masoud Sharbiani's avatar Masoud Sharbiani Committed by Bartlomiej Zolnierkiewicz
Browse files

ide: Fix pointer arithmetic in hpt3xx driver code (3rd try) 



git commit 74811f35 causes crash at
module load (or boot) time on my machine with a hpt374 controller.
The reason for this is that for initializing second controller which sets
(hwif->dev == host->dev[1]) to true (1), adds 1 to a void ptr, which
advances it by one byte instead of advancing it by sizeof(hpt_info) bytes.
Because of this, all initialization functions get corrupted data in info
variable which causes a crash at boot time.

This patch fixes that and makes my machine boot again.

The card itself is a HPT374 raid conroller: Here is the lspci -v output:
03:06.0 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev
07)
        Subsystem: HighPoint Technologies, Inc. Unknown device 0001
        Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28
        I/O ports at 8000 [size=8]
        I/O ports at 7800 [size=4]
        I/O ports at 7400 [size=8]
        I/O ports at 7000 [size=4]
        I/O ports at 6800 [size=256]
        Expansion ROM at fe8e0000 [disabled] [size=128K]
        Capabilities: [60] Power Management version 2

03:06.1 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev
07)
        Subsystem: HighPoint Technologies, Inc. Unknown device 0001
        Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28
        I/O ports at 9800 [size=8]
        I/O ports at 9400 [size=4]
        I/O ports at 9000 [size=8]
        I/O ports at 8800 [size=4]
        I/O ports at 8400 [size=256]
        Capabilities: [60] Power Management version 2

Signed-off-by: default avatarMasoud Sharbiani <masouds@google.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
[bart: use dev_get_drvdata() per Sergei's suggestion]
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
parent adee14b2

drivers/ide/pci/hpt366.c

+15 −16
Original line number Diff line number Diff line
@@ -613,6 +613,14 @@ static int check_in_drive_list(ide_drive_t *drive, const char **list) 
	return 0;

}



static struct hpt_info *hpt3xx_get_info(struct device *dev)

{

	struct ide_host *host	= dev_get_drvdata(dev);

	struct hpt_info *info	= (struct hpt_info *)host->host_priv;



	return dev == host->dev[1] ? info + 1 : info;

}



/*

 * The Marvell bridge chips used on the HighPoint SATA cards do not seem

 * to support the UltraDMA modes 1, 2, and 3 as well as any MWDMA modes...
@@ -621,9 +629,7 @@ static int check_in_drive_list(ide_drive_t *drive, const char **list) 
static u8 hpt3xx_udma_filter(ide_drive_t *drive)

{

	ide_hwif_t *hwif	= HWIF(drive);

	struct pci_dev *dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);

	u8 mask 		= hwif->ultra_mask;



	switch (info->chip_type) {
@@ -662,9 +668,7 @@ static u8 hpt3xx_udma_filter(ide_drive_t *drive) 
static u8 hpt3xx_mdma_filter(ide_drive_t *drive)

{

	ide_hwif_t *hwif	= HWIF(drive);

	struct pci_dev *dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);



	switch (info->chip_type) {

	case HPT372 :
@@ -700,8 +704,7 @@ static void hpt3xx_set_mode(ide_drive_t *drive, const u8 speed) 
{

	ide_hwif_t *hwif	= drive->hwif;

	struct pci_dev *dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);

	struct hpt_timings *t	= info->timings;

	u8  itr_addr		= 0x40 + (drive->dn * 4);

	u32 old_itr		= 0;
@@ -744,8 +747,7 @@ static void hpt3xx_maskproc(ide_drive_t *drive, int mask) 
{

	ide_hwif_t *hwif	= HWIF(drive);

	struct pci_dev	*dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);



	if (drive->quirk_list) {

		if (info->chip_type >= HPT370) {
@@ -973,8 +975,7 @@ static int __devinit hpt37x_calibrate_dpll(struct pci_dev *dev, u16 f_low, u16 f 
static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev)

{

	unsigned long io_base	= pci_resource_start(dev, 4);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (&dev->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(&dev->dev);

	const char *name	= DRV_NAME;

	u8 pci_clk,  dpll_clk	= 0;	/* PCI and DPLL clock in MHz */

	u8 chip_type;
@@ -1217,8 +1218,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev) 
static u8 hpt3xx_cable_detect(ide_hwif_t *hwif)

{

	struct pci_dev	*dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);

	u8 chip_type		= info->chip_type;

	u8 scr1 = 0, ata66	= hwif->channel ? 0x01 : 0x02;
@@ -1262,8 +1262,7 @@ static u8 hpt3xx_cable_detect(ide_hwif_t *hwif) 
static void __devinit init_hwif_hpt366(ide_hwif_t *hwif)

{

	struct pci_dev *dev	= to_pci_dev(hwif->dev);

	struct ide_host *host	= pci_get_drvdata(dev);

	struct hpt_info *info	= host->host_priv + (hwif->dev == host->dev[1]);

	struct hpt_info *info	= hpt3xx_get_info(hwif->dev);

	int serialize		= HPT_SERIALIZE_IO;

	u8  chip_type		= info->chip_type;

	u8  new_mcr, old_mcr	= 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE