Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c284c41 authored by Chris Brandt's avatar Chris Brandt Committed by Ulf Hansson
Browse files

mmc: tmio-mmc: fix bad pointer math 



The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
number in bytes. A cast of buf should have been used.

However, instead of casting, just change the code to use u32 pointers.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Fixes: 8185e51f: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by: default avatarChris Brandt <chris.brandt@renesas.com>
Reviewed-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Acked-by: default avatarWolfram Sang <wsa+renesas@sang-engineering.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
parent bbdc74dc

drivers/mmc/host/tmio_mmc_core.c

+9 −10
Original line number Diff line number Diff line
@@ -409,30 +409,29 @@ static void tmio_mmc_transfer_data(struct tmio_mmc_host *host, 
	 * Transfer the data

	 */

	if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {

		u8 data[4] = { };

		u32 data = 0;

		u32 *buf32 = (u32 *)buf;



		if (is_read)

			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,

			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,

					   count >> 2);

		else

			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,

			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,

					    count >> 2);



		/* if count was multiple of 4 */

		if (!(count & 0x3))

			return;



		buf8 = (u8 *)(buf + (count >> 2));

		buf32 += count >> 2;

		count %= 4;



		if (is_read) {

			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,

					   (u32 *)data, 1);

			memcpy(buf8, data, count);

			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1);

			memcpy(buf32, &data, count);

		} else {

			memcpy(data, buf8, count);

			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,

					    (u32 *)data, 1);

			memcpy(&data, buf32, count);

			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1);

		}



		return;