lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1407996435.6245.15.camel@debian-rtk5880> Date: Thu, 14 Aug 2014 06:06:20 +0000 From: Roger Tseng <rogerable@...ltek.com> To: Ulf Hansson <ulf.hansson@...aro.org> CC: Chris Ball <chris@...ntf.net>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Dan Carpenter <dan.carpenter@...cle.com>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, linux-mmc <linux-mmc@...r.kernel.org>, "driverdev-devel@...uxdriverproject.org" <driverdev-devel@...uxdriverproject.org>, Wei_wang <wei_wang@...lsil.com.cn>, micky <micky_ching@...lsil.com.cn> Subject: Re: [PATCH] mmc: rtsx: fix incorrect last byte in R2 response On Wed, 2014-08-13 at 17:09 +0200, Ulf Hansson wrote: > On 11 August 2014 10:32, <rogerable@...ltek.com> wrote: > > From: Roger Tseng <rogerable@...ltek.com> > > > > Current code erroneously fill the last byte of R2 response with an undefined > > value. In addition, it is impossible to obtain the real values since the > > controller actually 'offloads' the last byte(CRC7, end bit) while receiving R2 > > response. This could cause mmc stack to obtain inconsistent CID from the same > > card after resume and misidentify it as a different card. > > > > Fix by assigning a dummy value 0x01 to the last byte of R2 response. > > > > Signed-off-by: Roger Tseng <rogerable@...ltek.com> > > Thanks! Queued for 3.18. > > I guess this should go for stable as well? Yes. However, since rtsx_usb* is present in 3.16 and later, this patch will not apply on 3.15.y or older. Should I separately send an adapted version to stable? By the way, according to Dan's comment I would like to add a few word to explain the code. Would you help fix it up by following diff? diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c index 54849d8..ca31279 100644 --- a/drivers/mmc/host/rtsx_pci_sdmmc.c +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c @@ -412,7 +412,13 @@ static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host, } if (rsp_type == SD_RSP_TYPE_R2) { + /* + * The controller offloads the last byte {CRC-7, stop bit 1'b1} + * of response type R2. Assign a dummy CRC, 0, and stop bit to + * the byte(ptr[16], goes into the LSB of resp[3] later). + */ ptr[16] = 1; + for (i = 0; i < 4; i++) { cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c index ca08df1..727a88d 100644 --- a/drivers/mmc/host/rtsx_usb_sdmmc.c +++ b/drivers/mmc/host/rtsx_usb_sdmmc.c @@ -435,7 +435,13 @@ static void sd_send_cmd_get_rsp(struct rtsx_usb_sdmmc *host, } if (rsp_type == SD_RSP_TYPE_R2) { + /* + * The controller offloads the last byte {CRC-7, stop bit 1'b1} + * of response type R2. Assign a dummy CRC, 0, and stop bit to + * the byte(ptr[16], goes into the LSB of resp[3] later). + */ ptr[16] = 1; + for (i = 0; i < 4; i++) { cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4); dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n", -- Best regards, Roger Tseng
Powered by blists - more mailing lists