From 417dbb8ab2caa0f69f46681c4fd84ed93c3be68e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 3 Aug 2017 16:16:06 -0700 Subject: [PATCH] 4.12-stable patches added patches: mmc-tmio-mmc-fix-bad-pointer-math.patch --- .../mmc-tmio-mmc-fix-bad-pointer-math.patch | 71 +++++++++++++++++++ queue-4.12/series | 1 + 2 files changed, 72 insertions(+) create mode 100644 queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch diff --git a/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch b/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch new file mode 100644 index 00000000000..1222474a695 --- /dev/null +++ b/queue-4.12/mmc-tmio-mmc-fix-bad-pointer-math.patch @@ -0,0 +1,71 @@ +From 9c284c41c0886f09e75c323a16278b6d353b0b4a Mon Sep 17 00:00:00 2001 +From: Chris Brandt +Date: Wed, 12 Jul 2017 08:40:01 -0700 +Subject: mmc: tmio-mmc: fix bad pointer math + +From: Chris Brandt + +commit 9c284c41c0886f09e75c323a16278b6d353b0b4a upstream. + +The existing code gives an incorrect pointer value. +The buffer pointer 'buf' was of type unsigned short *, and 'count' was a +number in bytes. A cast of buf should have been used. + +However, instead of casting, just change the code to use u32 pointers. + +Reported-by: Dan Carpenter +Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port") +Signed-off-by: Chris Brandt +Reviewed-by: Geert Uytterhoeven +Acked-by: Wolfram Sang +Cc: +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/mmc/host/tmio_mmc_pio.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/mmc/host/tmio_mmc_pio.c ++++ b/drivers/mmc/host/tmio_mmc_pio.c +@@ -404,30 +404,29 @@ static void tmio_mmc_transfer_data(struc + * Transfer the data + */ + if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) { +- u8 data[4] = { }; ++ u32 data = 0; ++ u32 *buf32 = (u32 *)buf; + + if (is_read) +- sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf, ++ sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32, + count >> 2); + else +- sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf, ++ sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32, + count >> 2); + + /* if count was multiple of 4 */ + if (!(count & 0x3)) + return; + +- buf8 = (u8 *)(buf + (count >> 2)); ++ buf32 += count >> 2; + count %= 4; + + if (is_read) { +- sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, +- (u32 *)data, 1); +- memcpy(buf8, data, count); ++ sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1); ++ memcpy(buf32, &data, count); + } else { +- memcpy(data, buf8, count); +- sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, +- (u32 *)data, 1); ++ memcpy(&data, buf32, count); ++ sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1); + } + + return; diff --git a/queue-4.12/series b/queue-4.12/series index b669f5408d9..5db98ed3f28 100644 --- a/queue-4.12/series +++ b/queue-4.12/series @@ -28,3 +28,4 @@ drm-i915-fix-scaler-init-during-crtc-hw-state-readout.patch isdn-i4l-fix-buffer-overflow.patch ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch dentry-name-snapshots.patch +mmc-tmio-mmc-fix-bad-pointer-math.patch -- 2.47.3