]> git.baikalelectronics.ru Git - kernel.git/commit
mmc: renesas_sdhi: prevent overflow for max_req_size
authorWolfram Sang <wsa+renesas@sang-engineering.com>
Thu, 14 Mar 2019 22:31:30 +0000 (23:31 +0100)
committerUlf Hansson <ulf.hansson@linaro.org>
Mon, 15 Apr 2019 09:55:54 +0000 (11:55 +0200)
commitb51c0ed2d7e2e53d6d50bb4fd581c69f0348ea03
treee92abe26afa8f5a17c2bbb9906158079e486ad6d
parent9ad326d46b3e644033740fc16b8aa2ee74c219aa
mmc: renesas_sdhi: prevent overflow for max_req_size

max_req_size is calculated by 'max_blk_size * max_blk_count' in the TMIO
core. So, specifying U32_MAX as max_blk_count will overflow this
calculation. It will cause no harm in practice because the immense high
number will overflow into another immense high number. However, it is
not good coding practice, so calculate max_blk_count so that
max_req_size will fit into unsigned int on ARM32/64.

Thanks to the Renesas BSP team for the bug report!

Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
drivers/mmc/host/renesas_sdhi_internal_dmac.c
drivers/mmc/host/renesas_sdhi_sys_dmac.c