From a7de8a5ca7ff0b6d3a3a25fcba8d1e4becb88c4a Mon Sep 17 00:00:00 2001
From: Kever Yang <kever.yang@rock-chips.com>
Date: Wed, 2 May 2018 16:35:15 +0800
Subject: [PATCH] part: rkparm: fix issue when find the last part

The 'next' will be NULL if next ',' is not found, and access to
'*next' will end with "Synchronous Abort" in 64 bit system because
the memory space is reserved for Trust area.

Change-Id: Id8ee9d6f7815977d7c5996d67a3b72feb74d00cf
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
---
 disk/part_rkparm.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/disk/part_rkparm.c b/disk/part_rkparm.c
index 57fd941a51..0398e4d5ab 100644
--- a/disk/part_rkparm.c
+++ b/disk/part_rkparm.c
@@ -33,7 +33,7 @@ static int rkparm_param_parse(char *param, struct list_head *parts_head,
 {
 	struct rkparm_part *part;
 	const char *cmdline = strstr(param, "CMDLINE:");
-	const char *blkdev_parts, *blkdev_def;
+	const char *blkdev_parts;
 	char *cmdline_end, *next, *pend;
 	int len, offset = 0;
 	unsigned long size, start;
@@ -44,8 +44,7 @@ static int rkparm_param_parse(char *param, struct list_head *parts_head,
 	}
 
 	blkdev_parts = strstr(cmdline, "mtdparts");
-	blkdev_def = strchr(blkdev_parts, ':') + 1;
-	next = (char *)blkdev_def;
+	next = strchr(blkdev_parts, ':');
 	cmdline_end = strstr(cmdline, "\n"); /* end by '\n' */
 	*cmdline_end = '\0';
 	/* skip "CMDLINE:" */
@@ -57,13 +56,16 @@ static int rkparm_param_parse(char *param, struct list_head *parts_head,
 	 */
 	env_delete("bootargs", "initrd=");
 
-	while (*next) {
+	while (next) {
+		/* Skip ':' and ',' */
+		next++;
 		if (*next == '-') {
 			size = (~0UL);
 			next++;
 		} else {
 			size = simple_strtoul(next, &next, 16);
 		}
+		/* Skip '@' */
 		next++;
 		start = simple_strtoul(next, &next, 16);
 		next++;
@@ -82,9 +84,8 @@ static int rkparm_param_parse(char *param, struct list_head *parts_head,
 		part->size = size;
 		strncpy(part->name, next, len);
 		part->name[len] = '\0';
-		next = strchr(next, ',');
-		next++;
 		list_add_tail(&part->node, parts_head);
+		next = strchr(next, ',');
 	}
 
 	return 0;