[PATCH 1/2] spi: cadence_qspi: Off by 1 in test for timeout

Andrew Goodbody andrew.goodbody at linaro.org
Tue Aug 12 13:34:38 CEST 2025


In cadence_qspi_apb_exec_flash_cmd the test for a timeout uses a
post-decrement on the variable retry which will result in a value of -1
after the loop exit, or it would if the variable were signed.
To fix this make retry a signed variable and test its value for being
equal to -1.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
---
 drivers/spi/cadence_qspi_apb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/cadence_qspi_apb.c b/drivers/spi/cadence_qspi_apb.c
index 4696c09f754..0d4bc685f5d 100644
--- a/drivers/spi/cadence_qspi_apb.c
+++ b/drivers/spi/cadence_qspi_apb.c
@@ -354,7 +354,7 @@ void cadence_qspi_apb_controller_init(struct cadence_spi_priv *priv)
 
 int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg)
 {
-	unsigned int retry = CQSPI_REG_RETRY;
+	int retry = CQSPI_REG_RETRY;
 
 	/* Write the CMDCTRL without start execution. */
 	writel(reg, reg_base + CQSPI_REG_CMDCTRL);
@@ -369,7 +369,7 @@ int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg)
 		udelay(1);
 	}
 
-	if (!retry) {
+	if (retry == -1) {
 		printf("QSPI: flash command execution timeout\n");
 		return -EIO;
 	}

-- 
2.39.5



More information about the U-Boot mailing list