Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Unverified Commit 71f78731 authored by Ivan Vecera's avatar Ivan Vecera Committed by Michael Bestas
Browse files

mmc: sdhci-msm: Fix array-index-out-of-bounds



INVALID_TUNING_PHASE is defined to -1 but saved_tuning_phase is defined
as an unsigned integer. This causes the following UBSAN warning:

[    1.150177] UBSAN: Undefined behaviour in ../../../../../../kernel/xiaomi/sm6250/drivers/mmc/host/sdhci-msm.c:542:2
[    1.150180] index 255 is out of range for type 'u8 [16]'
[    1.150185] CPU: 6 PID: 87 Comm: kworker/6:1 Tainted: G S              4.14.190-lineageos-ge44e3bc2e-dirty #17
[    1.150187] Hardware name: Qualcomm Technologies, Inc. ATOLL-AB PM6150 wcd937x Audio Codec AB IDP CURTANA (DT)
[    1.150196] Workqueue: events_freezable mmc_rescan
[    1.150199] Call trace:
[    1.150204] dump_backtrace+0x0/0x1d0
[    1.150208] show_stack+0x18/0x24
[    1.150213] dump_stack+0xd8/0x114
[    1.150217] __ubsan_handle_out_of_bounds+0xc8/0x104
[    1.150220] msm_config_cm_dll_phase+0x238/0x248
[    1.150222] sdhci_msm_execute_tuning+0x2a0/0xb24
[    1.150225] sdhci_execute_tuning+0xcc/0x6c0
[    1.150228] mmc_execute_tuning+0x6c/0xc0
[    1.150230] mmc_sd_init_card+0x62c/0x6e0
[    1.150233] mmc_attach_sd+0xbc/0x2cc
[    1.150235] mmc_rescan+0x2ac/0x3a4
[    1.150239] process_one_work+0x260/0x45c
[    1.150241] worker_thread+0x258/0x494
[    1.150244] kthread+0x11c/0x12c
[    1.150247] ret_from_fork+0x10/0x18

Fix it by changing the saved_tuning_phase definition to a signed integer.

Signed-off-by: default avatarAlexander Winkowski <dereference23@outlook.com>
Change-Id: I9f53d4c7a7a543e77f6538253c485af61c0e7684
parent e69da001
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment