mmc: loongson2: Fix sg iteration in data reorder functions

In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),
the for_each_sg() macro already iterates over the scatterlist entries,
with 'sg' pointing to the current entry. However, the code incorrectly
uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats
'sg' as an array base and indexes it again, leading to access of
wrong sg entries (or out-of-bounds if the list is not an array).

Cc: stable@vger.kernel.org
Fixes: d0f8e961deae ("mmc: loongson2: Add Loongson-2K2000 SD/SDIO/eMMC controller driver")
Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver")
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>

diff --git a/drivers/mmc/host/loongson2-mmc.c b/drivers/mmc/host/loongson2-mmc.c
index f553e92fd9e541cab512eb7b5da2f2ea585defac..118eccbaf8cde1dcd8b553023ec8d8dbe4b3bc11 100644 (file)
--- a/drivers/mmc/host/loongson2-mmc.c
+++ b/drivers/mmc/host/loongson2-mmc.c
@@ -641,8 +641,8 @@ static void ls2k0500_mmc_reorder_cmd_data(struct loongson2_mmc_host *host,
                return;
 
        for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
-               data = sg_virt(&sg[i]);
-               for (j = 0; j < (sg_dma_len(&sg[i]) / 4); j++)
+               data = sg_virt(sg);
+               for (j = 0; j < (sg_dma_len(sg) / 4); j++)
                        if (cmd->opcode == SD_SWITCH)
                                data[j] = bitrev8x4(data[j]);
                        else
@@ -758,8 +758,8 @@ static void ls2k2000_mmc_reorder_cmd_data(struct loongson2_mmc_host *host,
                return;
 
        for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
-               data = sg_virt(&sg[i]);
-               for (j = 0; j < (sg_dma_len(&sg[i]) / 4); j++)
+               data = sg_virt(sg);
+               for (j = 0; j < (sg_dma_len(sg) / 4); j++)
                        data[j] = bitrev8x4(data[j]);
        }
 }