mmc: sdhci-msm: Fix array-index-out-of-bounds
INVALID_TUNING_PHASE is defined to -1 but saved_tuning_phase is defined
as an unsigned integer. This causes the following UBSAN warning:
[ 1.150177] UBSAN: Undefined behaviour in ../../../../../../kernel/xiaomi/sm6250/drivers/mmc/host/sdhci-msm.c:542:2
[ 1.150180] index 255 is out of range for type 'u8 [16]'
[ 1.150185] CPU: 6 PID: 87 Comm: kworker/6:1 Tainted: G S 4.14.190-lineageos-ge44e3bc2e-dirty #17
[ 1.150187] Hardware name: Qualcomm Technologies, Inc. ATOLL-AB PM6150 wcd937x Audio Codec AB IDP CURTANA (DT)
[ 1.150196] Workqueue: events_freezable mmc_rescan
[ 1.150199] Call trace:
[ 1.150204] dump_backtrace+0x0/0x1d0
[ 1.150208] show_stack+0x18/0x24
[ 1.150213] dump_stack+0xd8/0x114
[ 1.150217] __ubsan_handle_out_of_bounds+0xc8/0x104
[ 1.150220] msm_config_cm_dll_phase+0x238/0x248
[ 1.150222] sdhci_msm_execute_tuning+0x2a0/0xb24
[ 1.150225] sdhci_execute_tuning+0xcc/0x6c0
[ 1.150228] mmc_execute_tuning+0x6c/0xc0
[ 1.150230] mmc_sd_init_card+0x62c/0x6e0
[ 1.150233] mmc_attach_sd+0xbc/0x2cc
[ 1.150235] mmc_rescan+0x2ac/0x3a4
[ 1.150239] process_one_work+0x260/0x45c
[ 1.150241] worker_thread+0x258/0x494
[ 1.150244] kthread+0x11c/0x12c
[ 1.150247] ret_from_fork+0x10/0x18
Fix it by changing the saved_tuning_phase definition to a signed integer.
Signed-off-by:
Alexander Winkowski <dereference23@outlook.com>
Change-Id: I9f53d4c7a7a543e77f6538253c485af61c0e7684
Loading
Please register or sign in to comment