Re: [PATCH 2/5] I2O: SPARC fixes

[Al Viro]

	And here's another fun one:
                evt->size = size;
                evt->tcntxt = le32_to_cpu(msg->u.s.tcntxt);
                evt->event_indicator = le32_to_cpu(msg->body[0]);
                memcpy(&evt->tcntxt, &msg->u.s.tcntxt, size * 4);
in i2o_driver_dispatch().

We have
struct i2o_event {
        struct work_struct work;
        struct i2o_device *i2o_dev;     /* I2O device pointer from which the
                                           event reply was initiated */
        u16 size;               /* Size of data in 32-bit words */
        u32 tcntxt;             /* Transaction context used at
                                   registration */
        u32 event_indicator;    /* Event indicator from reply */
        u32 data[0];            /* Event data from reply */
};

and
in msg tcntxt goes right before body[0].  So we copy two 32bit values
converting to host order and then immediately overwrite them with
unconverted ones.

Looks like these assignments were meant to go *after* memcpy() and
serve as a fixup...
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/