diff mbox

[v2] mmc: tmio-mmc: fix bad pointer math

Message ID 20170712132701.69983-1-chris.brandt@renesas.com (mailing list archive)
State New, archived
Headers show

Commit Message

Chris Brandt July 12, 2017, 1:27 p.m. UTC
The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
number in bytes. A cast of buf should have been used.

However,instead of casting, just change the code to use u32 pointers.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
---
v2:
 * Use u32 pointers instead of casting
---
 drivers/mmc/host/tmio_mmc_core.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

Comments

Geert Uytterhoeven July 12, 2017, 3:24 p.m. UTC | #1
On Wed, Jul 12, 2017 at 3:27 PM, Chris Brandt <chris.brandt@renesas.com> wrote:
> The existing code gives an incorrect pointer value.
> The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
> number in bytes. A cast of buf should have been used.
>
> However,instead of casting, just change the code to use u32 pointers.
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
> Signed-off-by: Chris Brandt <chris.brandt@renesas.com>

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

> --- a/drivers/mmc/host/tmio_mmc_core.c
> +++ b/drivers/mmc/host/tmio_mmc_core.c

>                 if (is_read) {
>                         sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
> -                                          (u32 *)data, 1);
> +                                          &data, 1);

I would use the opportunity to merge the two above lines, now they fit
on a single line.

> +                       memcpy(buf32, &data, count);
>                 } else {
> -                       memcpy(data, buf8, count);
> +                       memcpy(&data, buf32, count);
>                         sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
> -                                           (u32 *)data, 1);
> +                                           &data, 1);

Likewise.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Chris Brandt July 12, 2017, 3:39 p.m. UTC | #2
Hi Geert,

On Wednesday, July 12, 2017 1, Geert Uytterhoeven wrote:
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

> > Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")

> > Signed-off-by: Chris Brandt <chris.brandt@renesas.com>

> 

> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>



As always, thank you for your review.


> >                 if (is_read) {

> >                         sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,

> > -                                          (u32 *)data, 1);

> > +                                          &data, 1);

> 

> I would use the opportunity to merge the two above lines, now they fit

> on a single line.

> 

> > +                       memcpy(buf32, &data, count);

> >                 } else {

> > -                       memcpy(data, buf8, count);

> > +                       memcpy(&data, buf32, count);

> >                         sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,

> > -                                           (u32 *)data, 1);

> > +                                           &data, 1);

> 

> Likewise.


Easy enough.

Done!


Thanks,
Chris
diff mbox

Patch

diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 77e7b56a9099..e4e35b6e2db5 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -415,30 +415,31 @@  static void tmio_mmc_transfer_data(struct tmio_mmc_host *host,
 	 * Transfer the data
 	 */
 	if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
-		u8 data[4] = { };
+		u32 data = 0;
+		u32 *buf32 = (u32 *)buf;
 
 		if (is_read)
-			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
 					   count >> 2);
 		else
-			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
 					    count >> 2);
 
 		/* if count was multiple of 4 */
 		if (!(count & 0x3))
 			return;
 
-		buf8 = (u8 *)(buf + (count >> 2));
+		buf32 += count >> 2;
 		count %= 4;
 
 		if (is_read) {
 			sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
-					   (u32 *)data, 1);
-			memcpy(buf8, data, count);
+					   &data, 1);
+			memcpy(buf32, &data, count);
 		} else {
-			memcpy(data, buf8, count);
+			memcpy(&data, buf32, count);
 			sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
-					    (u32 *)data, 1);
+					    &data, 1);
 		}
 
 		return;