Re: [PATCH 2/5] I2O: SPARC fixes

From: Al Viro
Date: Sun Nov 20 2005 - 18:06:50 EST

And here's another fun one:
evt->size = size;
evt->tcntxt = le32_to_cpu(msg->u.s.tcntxt);
evt->event_indicator = le32_to_cpu(msg->body[0]);
memcpy(&evt->tcntxt, &msg->u.s.tcntxt, size * 4);
in i2o_driver_dispatch().

We have
struct i2o_event {
struct work_struct work;
struct i2o_device *i2o_dev; /* I2O device pointer from which the
event reply was initiated */
u16 size; /* Size of data in 32-bit words */
u32 tcntxt; /* Transaction context used at
registration */
u32 event_indicator; /* Event indicator from reply */
u32 data[0]; /* Event data from reply */

in msg tcntxt goes right before body[0]. So we copy two 32bit values
converting to host order and then immediately overwrite them with
unconverted ones.

Looks like these assignments were meant to go *after* memcpy() and
serve as a fixup...
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at