4.12-stable patches

added patches:
	mmc-tmio-mmc-fix-bad-pointer-math.patch

diff --git a/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch b/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch
new file mode 100644 (file)
index 0000000..1222474
--- /dev/null
+++ b/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch
@@ -0,0 +1,71 @@
+From 9c284c41c0886f09e75c323a16278b6d353b0b4a Mon Sep 17 00:00:00 2001
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Wed, 12 Jul 2017 08:40:01 -0700
+Subject: mmc: tmio-mmc: fix bad pointer math
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+commit 9c284c41c0886f09e75c323a16278b6d353b0b4a upstream.
+
+The existing code gives an incorrect pointer value.
+The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
+number in bytes. A cast of buf should have been used.
+
+However, instead of casting, just change the code to use u32 pointers.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/mmc/host/tmio_mmc_pio.c |   19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -404,30 +404,29 @@ static void tmio_mmc_transfer_data(struc
+        * Transfer the data
+        */
+       if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
+-              u8 data[4] = { };
++              u32 data = 0;
++              u32 *buf32 = (u32 *)buf;
+ 
+               if (is_read)
+-                      sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
++                      sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
+                                          count >> 2);
+               else
+-                      sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
++                      sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
+                                           count >> 2);
+ 
+               /* if count was multiple of 4 */
+               if (!(count & 0x3))
+                       return;
+ 
+-              buf8 = (u8 *)(buf + (count >> 2));
++              buf32 += count >> 2;
+               count %= 4;
+ 
+               if (is_read) {
+-                      sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
+-                                         (u32 *)data, 1);
+-                      memcpy(buf8, data, count);
++                      sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1);
++                      memcpy(buf32, &data, count);
+               } else {
+-                      memcpy(data, buf8, count);
+-                      sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
+-                                          (u32 *)data, 1);
++                      memcpy(&data, buf32, count);
++                      sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1);
+               }
+ 
+               return;

diff --git a/queue-4.12/series b/queue-4.12/series
index b669f5408d9e51ae9293295132f1c4688035790c..5db98ed3f28c39f48116683e9db4e5f315223f25 100644 (file)
--- a/queue-4.12/series
+++ b/queue-4.12/series
@@ -28,3 +28,4 @@ drm-i915-fix-scaler-init-during-crtc-hw-state-readout.patch
 isdn-i4l-fix-buffer-overflow.patch
 ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch
 dentry-name-snapshots.patch
+mmc-tmio-mmc-fix-bad-pointer-math.patch