A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 19:51:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

mmc: tmio-mmc: fix bad pointer math

Browse source 
The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
number in bytes. A cast of buf should have been used.

However, instead of casting, just change the code to use u32 pointers.

Reported-by: Dan Carpenter <[email protected]>
Fixes: 8185e51f35: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by: Chris Brandt <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Acked-by: Wolfram Sang <[email protected]>
Cc: <[email protected]>
Signed-off-by: Ulf Hansson <[email protected]>
This commit is contained in:
Chris Brandt 2017-07-12 08:40:01 -07:00 • committed by Ulf Hansson
commit 9c284c41c0
1 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

19
drivers/mmc/host/tmio_mmc_core.c
View file

@ -409,30 +409,29 @@ static void tmio_mmc_transfer_data(struct tmio_mmc_host *host,
* Transfer the data
*/
if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
u8 data[4] = { };
u32 data = 0;
u32 *buf32 = (u32 *)buf;
if (is_read)
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
count >> 2);
else
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
count >> 2);
/* if count was multiple of 4 */
if (!(count & 0x3))
return;
buf8 = (u8 *)(buf + (count >> 2));
buf32 += count >> 2;
count %= 4;
if (is_read) {
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
(u32 *)data, 1);
memcpy(buf8, data, count);
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1);
memcpy(buf32, &data, count);
} else {
memcpy(data, buf8, count);
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
(u32 *)data, 1);
memcpy(&data, buf32, count);
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1);
}
return;