Skip to contentSkip to conversation

Patch "mmc: tmio-mmc: fix bad pointer math" has been added to the 4.12-stable tree

PATCH [email protected] 1 participant 1 message Aug 3, 2017

Subsystems (3)
Stable branch MMC, SD and SDIO TMIO/SDHI MMC driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

mmc: tmio-mmc: fix bad pointer math

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mmc-tmio-mmc-fix-bad-pointer-math.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 9c284c41c0886f09e75c323a16278b6d353b0b4a Mon Sep 17 00:00:00 2001

From: Chris Brandt <[email protected]>
Date: Wed, 12 Jul 2017 08:40:01 -0700
Subject: mmc: tmio-mmc: fix bad pointer math

From: Chris Brandt <[email protected]>

commit 9c284c41c0886f09e75c323a16278b6d353b0b4a upstream.

The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a number in bytes. A cast of buf should have been used.

However, instead of casting, just change the code to use u32 pointers.

Reported-by Dan Carpenter <[email protected]>
Fixes 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by Chris Brandt <[email protected]>
Reviewed-by Geert Uytterhoeven <[email protected]>
Acked-by Wolfram Sang <[email protected]>
Cc <[email protected]>
Signed-off-by Ulf Hansson <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/mmc/host/tmio_mmc_pio.c |   19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/mmc/host/tmio_mmc_pio.c +9 -10
@@ -404,30 +404,29 @@ static void tmio_mmc_transfer_data(struc
 	 * Transfer the data
 	 */
 	if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
-		u8 data[4] = { };
+		u32 data = 0;
+		u32 *buf32 = (u32 *)buf;
 
 		if (is_read)
-			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
 					   count >> 2);
 		else
-			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
 					    count >> 2);
 
 		/* if count was multiple of 4 */
 		if (!(count & 0x3))
 			return;
 
-		buf8 = (u8 *)(buf + (count >> 2));
+		buf32 += count >> 2;
 		count %= 4;
 
 		if (is_read) {
-			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
-					   (u32 *)data, 1);
-			memcpy(buf8, data, count);
+			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1);
+			memcpy(buf32, &data, count);
 		} else {
-			memcpy(data, buf8, count);
-			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
-					    (u32 *)data, 1);
+			memcpy(&data, buf32, count);
+			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1);
 		}
 
 		return;

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch