From b3616879528d5f8afb24238c5b9ebfe09a95f5b2 Mon Sep 17 00:00:00 2001 From: Sujit Reddy Thumma Date: Thu, 5 Dec 2013 19:35:43 +0530 Subject: [PATCH] mmc: core: fix buffer overflow during memcpy of ext_csd Fix buffer overflow while caching the mmc ext_csd content. Also, to avoid duplicate allocation keep the allocated ext_csd till the card is removed. CRs-Fixed: 583929 Change-Id: I5d69e37f6fd1f5249479d454c353be050df40b6d Signed-off-by: Sujit Reddy Thumma --- drivers/mmc/core/bus.c | 1 + drivers/mmc/core/mmc.c | 9 +++------ include/linux/mmc/card.h | 2 +- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c index eb5d3652f40..c194ede66b6 100644 --- a/drivers/mmc/core/bus.c +++ b/drivers/mmc/core/bus.c @@ -469,6 +469,7 @@ void mmc_remove_card(struct mmc_card *card) } kfree(card->wr_pack_stats.packing_events); + kfree(card->cached_ext_csd); put_device(&card->dev); } diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c index 997e14b25b7..b295bb86ed3 100644 --- a/drivers/mmc/core/mmc.c +++ b/drivers/mmc/core/mmc.c @@ -1189,9 +1189,9 @@ int mmc_set_clock_bus_speed(struct mmc_card *card, unsigned long freq) mmc_set_timing(card->host, MMC_TIMING_LEGACY); mmc_set_clock(card->host, MMC_HIGH_26_MAX_DTR); - err = mmc_select_hs(card, &card->cached_ext_csd); + err = mmc_select_hs(card, card->cached_ext_csd); } else { - err = mmc_select_hs400(card, &card->cached_ext_csd); + err = mmc_select_hs400(card, card->cached_ext_csd); } return err; @@ -1439,7 +1439,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, err = mmc_get_ext_csd(card, &ext_csd); if (err) goto free_card; - memcpy(&card->cached_ext_csd, ext_csd, sizeof(card->ext_csd)); + card->cached_ext_csd = ext_csd; err = mmc_read_ext_csd(card, ext_csd); if (err) goto free_card; @@ -1637,15 +1637,12 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, if (!oldcard) host->card = card; - mmc_free_ext_csd(ext_csd); return 0; free_card: if (!oldcard) mmc_remove_card(card); err: - mmc_free_ext_csd(ext_csd); - return err; } diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h index 1bcfd284d4d..43aebb50641 100644 --- a/include/linux/mmc/card.h +++ b/include/linux/mmc/card.h @@ -392,7 +392,7 @@ struct mmc_card { unsigned int idle_timeout; struct notifier_block reboot_notify; bool issue_long_pon; - u8 cached_ext_csd; + u8 *cached_ext_csd; }; /*