Merge "mmc: core: fix buffer overflow during memcpy of ext_csd" (49110a93) · Commits · e / devices / android_kernel_sony_msm8994

drivers/mmc/core/bus.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -472,6 +472,7 @@ void mmc_remove_card(struct mmc_card *card)
		}

		kfree(card->wr_pack_stats.packing_events);
		kfree(card->cached_ext_csd);

		put_device(&card->dev);
		}

+3 −6

Original line number	Diff line number	Diff line
		@@ -1191,9 +1191,9 @@ int mmc_set_clock_bus_speed(struct mmc_card *card, unsigned long freq)
		mmc_set_timing(card->host, MMC_TIMING_LEGACY);
		mmc_set_clock(card->host, MMC_HIGH_26_MAX_DTR);

		err = mmc_select_hs(card, &card->cached_ext_csd);
		err = mmc_select_hs(card, card->cached_ext_csd);
		} else {
		err = mmc_select_hs400(card, &card->cached_ext_csd);
		err = mmc_select_hs400(card, card->cached_ext_csd);
		}

		return err;
		@@ -1438,7 +1438,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
		err = mmc_get_ext_csd(card, &ext_csd);
		if (err)
		goto free_card;
		memcpy(&card->cached_ext_csd, ext_csd, sizeof(card->ext_csd));
		card->cached_ext_csd = ext_csd;
		err = mmc_read_ext_csd(card, ext_csd);
		if (err)
		goto free_card;
		@@ -1639,15 +1639,12 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
		if (!oldcard)
		host->card = card;

		mmc_free_ext_csd(ext_csd);
		return 0;

		free_card:
		if (!oldcard)
		mmc_remove_card(card);
		err:
		mmc_free_ext_csd(ext_csd);

		return err;
		}

+1 −1

Original line number	Diff line number	Diff line
		@@ -394,7 +394,7 @@ struct mmc_card {
		unsigned int idle_timeout;
		struct notifier_block reboot_notify;
		bool issue_long_pon;
		u8 cached_ext_csd;
		u8 *cached_ext_csd;
		};

		/*