Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02bf86d2 authored by Sujit Reddy Thumma's avatar Sujit Reddy Thumma Committed by Subhash Jadavani
Browse files

mmc: core: fix buffer overflow during memcpy of ext_csd 



Fix buffer overflow while caching the mmc ext_csd content.
Also, to avoid duplicate allocation keep the allocated ext_csd
till the card is removed.

CRs-Fixed: 583929
Change-Id: I5d69e37f6fd1f5249479d454c353be050df40b6d
Signed-off-by: default avatarSujit Reddy Thumma <sthumma@codeaurora.org>
[subhashj@codeaurora.org: fixed trivial merge conflicts]
Signed-off-by: default avatarSubhash Jadavani <subhashj@codeaurora.org>
parent 96bf8836

drivers/mmc/core/bus.c

+1 −0
Original line number Diff line number Diff line
@@ -399,6 +399,7 @@ void mmc_remove_card(struct mmc_card *card) 
	}



	kfree(card->wr_pack_stats.packing_events);

	kfree(card->cached_ext_csd);



	put_device(&card->dev);

}

drivers/mmc/core/mmc.c

+1 −1
Original line number Diff line number Diff line
@@ -624,7 +624,7 @@ static int mmc_read_ext_csd(struct mmc_card *card) 
		return err;

	}



	memcpy(&card->cached_ext_csd, ext_csd, sizeof(card->ext_csd));

	card->cached_ext_csd = ext_csd;

	err = mmc_decode_ext_csd(card, ext_csd);

	kfree(ext_csd);

	return err;

include/linux/mmc/card.h

+1 −1
Original line number Diff line number Diff line
@@ -345,7 +345,7 @@ struct mmc_card { 
	struct mmc_wr_pack_stats wr_pack_stats; /* packed commands stats*/

	struct notifier_block        reboot_notify;

	bool issue_long_pon;

	u8 cached_ext_csd;

	u8 *cached_ext_csd;

};



/*