From: Peng Fan Date: Mon, 13 Jul 2026 13:32:53 +0000 (+0800) Subject: mmc: rpmb: fix tautological condition in RPMB_REQ_READ_DATA validation X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=67d06fe102712dc07e05bbdf893fc48ba73c86a6;p=thirdparty%2Fu-boot.git mmc: rpmb: fix tautological condition in RPMB_REQ_READ_DATA validation In rpmb_route_frames(), the RPMB_REQ_READ_DATA case checks "req_cnt != 1 || !req_cnt" which is tautological -- !req_cnt (req_cnt == 0) is always a subset of req_cnt != 1. The second operand is dead code. Based on the pattern of all other cases in the switch (RPMB_REQ_KEY, RPMB_REQ_WRITE_DATA, RPMB_REQ_WCOUNTER) which validate rsp_cnt, this was meant to be "req_cnt != 1 || !rsp_cnt". Without this fix, a caller could pass rsp_cnt=0 for a read request without validation. Signed-off-by: Peng Fan --- diff --git a/drivers/mmc/rpmb.c b/drivers/mmc/rpmb.c index 8bfdffd56f5..26d2262ef45 100644 --- a/drivers/mmc/rpmb.c +++ b/drivers/mmc/rpmb.c @@ -452,7 +452,7 @@ static int rpmb_route_frames(struct mmc *mmc, struct s_rpmb *req, return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt); case RPMB_REQ_READ_DATA: - if (req_cnt != 1 || !req_cnt) + if (req_cnt != 1 || !rsp_cnt) return -EINVAL; return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt);