mtd: nand: r852: correct write_buf loop bounds

The two loops in r852_write_buf() are designed to handle 4-byte-aligned
and then 1-byte-aligned portions, respectively. However, there are two
issues:

(1) The first loop will only terminate if 'len' is a multiple of 4
(2) The second loop will never terminate if it runs at least once

Rewrite these loops as they were probably intended. Compile tested only.

Issues pointed out by Coverity Scan.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>

diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 325930db3f0481b28cec6bbeda63fc2e03052d78..baea83f4dea84f0f0f3d9917e1797b47cb262fca 100644 (file)
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -245,7 +245,7 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
        }
 
        /* write DWORD chinks - faster */
-       while (len) {
+       while (len >= 4) {
                reg = buf[0] | buf[1] << 8 | buf[2] << 16 | buf[3] << 24;
                r852_write_reg_dword(dev, R852_DATALINE, reg);
                buf += 4;
@@ -254,8 +254,10 @@ static void r852_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
        }
 
        /* write rest */
-       while (len)
+       while (len > 0) {
                r852_write_reg(dev, R852_DATALINE, *buf++);
+               len--;
+       }
 }
 
 /*