From: Andrew Goodbody <andrew.goodbody@linaro.org>
Date: Tue, 12 Aug 2025 11:34:38 +0000 (+0100)
Subject: spi: cadence_qspi: Off by 1 in test for timeout
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0ed45794ae9fa3bd8adb1f2d85875f93d94249f8;p=thirdparty%2Fu-boot.git

spi: cadence_qspi: Off by 1 in test for timeout

In cadence_qspi_apb_exec_flash_cmd the test for a timeout uses a
post-decrement on the variable retry which will result in a value of -1
after the loop exit, or it would if the variable were signed.
To fix this make retry a signed variable and test its value for being
equal to -1.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
---

diff --git a/drivers/spi/cadence_qspi_apb.c b/drivers/spi/cadence_qspi_apb.c
index 4696c09f754..0d4bc685f5d 100644
--- a/drivers/spi/cadence_qspi_apb.c
+++ b/drivers/spi/cadence_qspi_apb.c
@@ -354,7 +354,7 @@ void cadence_qspi_apb_controller_init(struct cadence_spi_priv *priv)
 
 int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg)
 {
-	unsigned int retry = CQSPI_REG_RETRY;
+	int retry = CQSPI_REG_RETRY;
 
 	/* Write the CMDCTRL without start execution. */
 	writel(reg, reg_base + CQSPI_REG_CMDCTRL);
@@ -369,7 +369,7 @@ int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg)
 		udelay(1);
 	}
 
-	if (!retry) {
+	if (retry == -1) {
 		printf("QSPI: flash command execution timeout\n");
 		return -EIO;
 	}