From 799d5eb4e7aede8ddfcdd313eeb875f4eea860be Mon Sep 17 00:00:00 2001 From: Janusz Krzysztofik Date: Sat, 29 Sep 2018 14:20:22 +0200 Subject: [PATCH] gpiolib: Fix incorrect use of find_next_zero_bit() Commit b17566a6b08b ("gpiolib: Implement fast processing path in get/set array"), already fixed to some extent with commit 5d581d7e8cdc ("gpiolib: Fix missing updates of bitmap index"), introduced a new mode of processing bitmaps where bits applicable for fast bitmap processing path are supposed to be skipped while iterating bits which don't apply. Unfortunately, find_next_zero_bit() function supposed to skip over those fast bits is always called with a 'start' argument equal to an index of last zero bit found and returns that index value again an again, causing an infinite loop. Fix it by incrementing the index uncoditionally before find_next_zero_bit() is optionally called. Reported-by: Marek Szyprowski Signed-off-by: Janusz Krzysztofik Tested-by: Marek Szyprowski Signed-off-by: Linus Walleij --- drivers/gpio/gpiolib.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 4ce402f..a293f14 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2920,12 +2920,11 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep, int hwgpio = gpio_chip_hwgpio(desc); __set_bit(hwgpio, mask); + i++; if (array_info) i = find_next_zero_bit(array_info->get_mask, array_size, i); - else - i++; } while ((i < array_size) && (desc_array[i]->gdev->chip == chip)); @@ -2945,12 +2944,11 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep, value = !value; __assign_bit(j, value_bitmap, value); trace_gpio_value(desc_to_gpio(desc), 1, value); + j++; if (array_info) j = find_next_zero_bit(array_info->get_mask, i, j); - else - j++; } if (mask != fastpath) @@ -3233,12 +3231,11 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep, __clear_bit(hwgpio, bits); count++; } + i++; if (array_info) i = find_next_zero_bit(array_info->set_mask, array_size, i); - else - i++; } while ((i < array_size) && (desc_array[i]->gdev->chip == chip)); /* push collected bits to outputs */ -- 2.7.4