From 5804509e652fd26227f6da732d5445af444730d3 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Wed, 17 Oct 2007 04:08:48 -0700 Subject: Fix loop terminating conditions in fill_sg(). Signed-off-by: David S. Miller Signed-off-by: Jens Axboe --- arch/sparc64/kernel/pci_sun4v.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'arch/sparc64/kernel/pci_sun4v.c') diff --git a/arch/sparc64/kernel/pci_sun4v.c b/arch/sparc64/kernel/pci_sun4v.c index 119f8efa03d..fe46ace3e59 100644 --- a/arch/sparc64/kernel/pci_sun4v.c +++ b/arch/sparc64/kernel/pci_sun4v.c @@ -368,12 +368,11 @@ static void dma_4v_unmap_single(struct device *dev, dma_addr_t bus_addr, #define SG_ENT_PHYS_ADDRESS(SG) \ (__pa(page_address((SG)->page)) + (SG)->offset) -static inline long fill_sg(long entry, struct device *dev, - struct scatterlist *sg, - int nused, int nelems, unsigned long prot) +static long fill_sg(long entry, struct device *dev, + struct scatterlist *sg, + int nused, int nelems, unsigned long prot) { struct scatterlist *dma_sg = sg; - struct scatterlist *sg_end = sg_last(sg, nelems); unsigned long flags; int i; @@ -414,6 +413,7 @@ static inline long fill_sg(long entry, struct device *dev, break; } sg = sg_next(sg); + nelems--; } pteval = (pteval & IOPTE_PAGE); @@ -432,19 +432,20 @@ static inline long fill_sg(long entry, struct device *dev, pteval = (pteval & IOPTE_PAGE) + len; sg = sg_next(sg); + nelems--; /* Skip over any tail mappings we've fully mapped, * adjusting pteval along the way. Stop when we * detect a page crossing event. */ - while ((pteval << (64 - IO_PAGE_SHIFT)) != 0UL && + while (nelems && + (pteval << (64 - IO_PAGE_SHIFT)) != 0UL && (pteval == SG_ENT_PHYS_ADDRESS(sg)) && ((pteval ^ (SG_ENT_PHYS_ADDRESS(sg) + sg->length - 1UL)) >> IO_PAGE_SHIFT) == 0UL) { pteval += sg->length; - if (sg == sg_end) - break; sg = sg_next(sg); + nelems--; } if ((pteval << (64 - IO_PAGE_SHIFT)) == 0UL) pteval = ~0UL; -- cgit v1.2.3