Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 039ac440 authored by Sujit Reddy Thumma's avatar Sujit Reddy Thumma
Browse files

mmc: core: fix buffer overflow during memcpy of ext_csd 



Fix buffer overflow while caching the mmc ext_csd content.
Also, to avoid duplicate allocation keep the allocated ext_csd
till the card is removed.

CRs-Fixed: 583929
Change-Id: I5d69e37f6fd1f5249479d454c353be050df40b6d
Signed-off-by: default avatarSujit Reddy Thumma <sthumma@codeaurora.org>
parent 9e79afb8

drivers/mmc/core/bus.c

+1 −0
Original line number Diff line number Diff line
@@ -472,6 +472,7 @@ void mmc_remove_card(struct mmc_card *card) 
	}



	kfree(card->wr_pack_stats.packing_events);

	kfree(card->cached_ext_csd);



	put_device(&card->dev);

}

drivers/mmc/core/mmc.c

+3 −6
Original line number Diff line number Diff line
@@ -1191,9 +1191,9 @@ int mmc_set_clock_bus_speed(struct mmc_card *card, unsigned long freq) 
		mmc_set_timing(card->host, MMC_TIMING_LEGACY);

		mmc_set_clock(card->host, MMC_HIGH_26_MAX_DTR);



		err = mmc_select_hs(card, &card->cached_ext_csd);

		err = mmc_select_hs(card, card->cached_ext_csd);

	} else {

		err = mmc_select_hs400(card, &card->cached_ext_csd);

		err = mmc_select_hs400(card, card->cached_ext_csd);

	}



	return err;
@@ -1438,7 +1438,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, 
		err = mmc_get_ext_csd(card, &ext_csd);

		if (err)

			goto free_card;

		memcpy(&card->cached_ext_csd, ext_csd, sizeof(card->ext_csd));

		card->cached_ext_csd = ext_csd;

		err = mmc_read_ext_csd(card, ext_csd);

		if (err)

			goto free_card;
@@ -1639,15 +1639,12 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, 
	if (!oldcard)

		host->card = card;



	mmc_free_ext_csd(ext_csd);

	return 0;



free_card:

	if (!oldcard)

		mmc_remove_card(card);

err:

	mmc_free_ext_csd(ext_csd);



	return err;

}

include/linux/mmc/card.h

+1 −1
Original line number Diff line number Diff line
@@ -394,7 +394,7 @@ struct mmc_card { 
	unsigned int		idle_timeout;

	struct notifier_block        reboot_notify;

	bool issue_long_pon;

	u8 cached_ext_csd;

	u8 *cached_ext_csd;

};



/*