linux-kernel - [PATCH 2/2] mmc: rtsx: check sg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55d9f11a9338acd70f820673d4548ac9939dabc6.1421204431.git.micky_ching@realsil.com.cn>
Date:	Wed, 14 Jan 2015 11:09:12 +0800
From:	<micky_ching@...lsil.com.cn>
To:	<chris@...ntf.net>, <ulf.hansson@...aro.org>,
	<sameo@...ux.intel.com>
CC:	<gregkh@...uxfoundation.org>, <dan.carpenter@...cle.com>,
	<devel@...uxdriverproject.org>, <linux-kernel@...r.kernel.org>,
	<linux-mmc@...r.kernel.org>, <rogerable@...ltek.com>,
	<wei_wang@...lsil.com.cn>, Micky Ching <micky_ching@...lsil.com.cn>
Subject: [PATCH 2/2] mmc: rtsx: check sg_count before long data xfer

From: Micky Ching <micky_ching@...lsil.com.cn>

Check sg_count before sending long data xfer.
Because dma_map_sg() return int, and sg_count may be negative,
so using int instead of unsigned.

Signed-off-by: Micky Ching <micky_ching@...lsil.com.cn>
---
 drivers/mmc/host/rtsx_pci_sdmmc.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index b435806..1d3d6c4 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -54,9 +54,9 @@ struct realtek_pci_sdmmc {
 #define SDMMC_POWER_ON		1
 #define SDMMC_POWER_OFF		0
 
-	unsigned int		sg_count;
+	int			sg_count;
 	s32			cookie;
-	unsigned int		cookie_sg_count;
+	int			cookie_sg_count;
 	bool			using_cookie;
 };
 
@@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
 {
 	struct mmc_data *data = mrq->data;
 
+	if (host->sg_count < 0) {
+		data->error = host->sg_count;
+		dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
+			__func__, host->sg_count);
+		return data->error;
+	}
+
 	if (data->flags & MMC_DATA_READ)
 		return sd_read_long_data(host, mrq);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/