staging: brcm80211: fix off-by-one error in swap functions
authorHenry Ptasinski <henryp@broadcom.com>
Mon, 15 Aug 2011 13:34:21 +0000 (15:34 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 23 Aug 2011 20:08:05 +0000 (13:08 -0700)
The original implementation iterated over the data in buf+1 through buf+size,
whereas it should have been over the data in buf through buf+size-1.

Tested on Mac G5 PPC and BCM63281.

Signed-off-by: Henry Ptasinski <henryp@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Tested-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/brcm80211/brcmsmac/srom.c

index 060f06fc144061ef74cd6fa5e3efd4a171f6fb43..7a17f598e499f3cb229b37338610379d08048d6c 100644 (file)
@@ -880,13 +880,15 @@ int srom_var_init(struct si_pub *sih, void *curmap, char **vars, uint *count)
 
 static inline void ltoh16_buf(u16 *buf, unsigned int size)
 {
-       for (size /= 2; size; size--)
+       size /= 2;
+       while (size--)
                *(buf + size) = le16_to_cpu(*(buf + size));
 }
 
 static inline void htol16_buf(u16 *buf, unsigned int size)
 {
-       for (size /= 2; size; size--)
+       size /= 2;
+       while (size--)
                *(buf + size) = cpu_to_le16(*(buf + size));
 }