rubenslte/android_kernel_samsung_msm8226
1
Fork 1
mirror of https://github.com/LineageOS/android_kernel_samsung_msm8226.git synced 2026-09-29 00:00:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge "mmc: core: fix buffer overflow during memcpy of ext_csd"

Browse Source
This commit is contained in:
Linux Build Service Account
2013-12-17 02:53:31 -08:00
committed by Gerrit - the friendly Code Review server
parent be1077dd11 b361687952
commit 2fa29dee7e
3 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/mmc/core/bus.c
+1
View File
@@ -467,6 +467,7 @@ void mmc_remove_card(struct mmc_card *card)
}
kfree(card->wr_pack_stats.packing_events);
kfree(card->cached_ext_csd);
put_device(&card->dev);
}
drivers/mmc/core/mmc.c
+3 -6
View File
@@ -1189,9 +1189,9 @@ int mmc_set_clock_bus_speed(struct mmc_card *card, unsigned long freq)
mmc_set_timing(card->host, MMC_TIMING_LEGACY);
mmc_set_clock(card->host, MMC_HIGH_26_MAX_DTR);
err = mmc_select_hs(card, &card->cached_ext_csd);
err = mmc_select_hs(card, card->cached_ext_csd);
} else {
err = mmc_select_hs400(card, &card->cached_ext_csd);
err = mmc_select_hs400(card, card->cached_ext_csd);
}
return err;
@@ -1439,7 +1439,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
err = mmc_get_ext_csd(card, &ext_csd);
if (err)
goto free_card;
memcpy(&card->cached_ext_csd, ext_csd, sizeof(card->ext_csd));
card->cached_ext_csd = ext_csd;
err = mmc_read_ext_csd(card, ext_csd);
if (err)
goto free_card;
@@ -1637,15 +1637,12 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
if (!oldcard)
host->card = card;
mmc_free_ext_csd(ext_csd);
return 0;
free_card:
if (!oldcard)
mmc_remove_card(card);
err:
mmc_free_ext_csd(ext_csd);
return err;
}
include/linux/mmc/card.h
+1 -1
View File
@@ -392,7 +392,7 @@ struct mmc_card {
unsigned int idle_timeout;
struct notifier_block reboot_notify;
bool issue_long_pon;
u8 cached_ext_csd;
u8 *cached_ext_csd;
};
/*