From patchwork Thu Mar 14 22:31:29 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wolfram Sang X-Patchwork-Id: 10853765 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 690DC15AC for ; Thu, 14 Mar 2019 22:32:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5B20F2A7B7 for ; Thu, 14 Mar 2019 22:32:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4F6712A7E8; Thu, 14 Mar 2019 22:32:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B22C02A7E3 for ; Thu, 14 Mar 2019 22:32:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727523AbfCNWcD (ORCPT ); Thu, 14 Mar 2019 18:32:03 -0400 Received: from sauhun.de ([88.99.104.3]:60950 "EHLO pokefinder.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726885AbfCNWcC (ORCPT ); Thu, 14 Mar 2019 18:32:02 -0400 Received: from localhost (p54B33449.dip0.t-ipconnect.de [84.179.52.73]) by pokefinder.org (Postfix) with ESMTPSA id 8C0EA3E600A; Thu, 14 Mar 2019 23:32:00 +0100 (CET) From: Wolfram Sang To: linux-mmc@vger.kernel.org Cc: linux-renesas-soc@vger.kernel.org, Yoshihiro Shimoda , Masahiro Yamada , =?utf-8?q?Niklas_S=C3=B6de?= =?utf-8?q?rlund?= , Wolfram Sang Subject: [RFC PATCH 1/2] mmc: tmio: introduce macro for max block size Date: Thu, 14 Mar 2019 23:31:29 +0100 Message-Id: <20190314223130.31802-2-wsa+renesas@sang-engineering.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190314223130.31802-1-wsa+renesas@sang-engineering.com> References: <20190314223130.31802-1-wsa+renesas@sang-engineering.com> Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We will need it later for other calculations. Signed-off-by: Wolfram Sang --- drivers/mmc/host/tmio_mmc.h | 2 ++ drivers/mmc/host/tmio_mmc_core.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h index 2adb0d24360f..64e00d8f3a88 100644 --- a/drivers/mmc/host/tmio_mmc.h +++ b/drivers/mmc/host/tmio_mmc.h @@ -105,6 +105,8 @@ TMIO_STAT_CARD_REMOVE | TMIO_STAT_CARD_INSERT) #define TMIO_MASK_IRQ (TMIO_MASK_READOP | TMIO_MASK_WRITEOP | TMIO_MASK_CMD) +#define TMIO_MAX_BLK_SIZE 512 + struct tmio_mmc_data; struct tmio_mmc_host; diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c index 595949f1f001..dfc15ce41191 100644 --- a/drivers/mmc/host/tmio_mmc_core.c +++ b/drivers/mmc/host/tmio_mmc_core.c @@ -1186,7 +1186,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; mmc->caps2 |= pdata->capabilities2; mmc->max_segs = pdata->max_segs ? : 32; - mmc->max_blk_size = 512; + mmc->max_blk_size = TMIO_MAX_BLK_SIZE; mmc->max_blk_count = pdata->max_blk_count ? : (PAGE_SIZE / mmc->max_blk_size) * mmc->max_segs; mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count; From patchwork Thu Mar 14 22:31:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wolfram Sang X-Patchwork-Id: 10853763 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C1E2918A6 for ; Thu, 14 Mar 2019 22:32:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B40292A78B for ; Thu, 14 Mar 2019 22:32:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B284D2A7C1; Thu, 14 Mar 2019 22:32:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5837C2A7E7 for ; Thu, 14 Mar 2019 22:32:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727426AbfCNWcD (ORCPT ); Thu, 14 Mar 2019 18:32:03 -0400 Received: from sauhun.de ([88.99.104.3]:60972 "EHLO pokefinder.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727495AbfCNWcD (ORCPT ); Thu, 14 Mar 2019 18:32:03 -0400 Received: from localhost (p54B33449.dip0.t-ipconnect.de [84.179.52.73]) by pokefinder.org (Postfix) with ESMTPSA id 1536E3E430A; Thu, 14 Mar 2019 23:32:01 +0100 (CET) From: Wolfram Sang To: linux-mmc@vger.kernel.org Cc: linux-renesas-soc@vger.kernel.org, Yoshihiro Shimoda , Masahiro Yamada , =?utf-8?q?Niklas_S=C3=B6de?= =?utf-8?q?rlund?= , Wolfram Sang Subject: [RFC PATCH 2/2] mmc: renesas_sdhi: prevent overflow for max_req_size Date: Thu, 14 Mar 2019 23:31:30 +0100 Message-Id: <20190314223130.31802-3-wsa+renesas@sang-engineering.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190314223130.31802-1-wsa+renesas@sang-engineering.com> References: <20190314223130.31802-1-wsa+renesas@sang-engineering.com> Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP max_req_size is calculated by 'max_blk_size * max_blk_count' in the TMIO core. So, specifying U32_MAX as max_blk_count will overflow this calculation. It will cause no harm in practice because the immense high number will overflow into another immense high number. However, it is not good coding practice, so calculate max_blk_count so that max_req_size will fit into unsigned int on ARM32/64. Thanks to the Renesas BSP team for the bug report! Reported-by: Yoshihiro Shimoda Signed-off-by: Wolfram Sang --- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 8 ++++---- drivers/mmc/host/renesas_sdhi_sys_dmac.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c index 9dfafa2a90a3..af0288f04200 100644 --- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c +++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c @@ -95,8 +95,8 @@ static const struct renesas_sdhi_of_data of_rza2_compatible = { .scc_offset = 0 - 0x1000, .taps = rcar_gen3_scc_taps, .taps_num = ARRAY_SIZE(rcar_gen3_scc_taps), - /* DMAC can handle 0xffffffff blk count but only 1 segment */ - .max_blk_count = 0xffffffff, + /* DMAC can handle 32bit blk count but only 1 segment */ + .max_blk_count = UINT_MAX / TMIO_MAX_BLK_SIZE, .max_segs = 1, }; @@ -110,8 +110,8 @@ static const struct renesas_sdhi_of_data of_rcar_gen3_compatible = { .scc_offset = 0x1000, .taps = rcar_gen3_scc_taps, .taps_num = ARRAY_SIZE(rcar_gen3_scc_taps), - /* DMAC can handle 0xffffffff blk count but only 1 segment */ - .max_blk_count = 0xffffffff, + /* DMAC can handle 32bit blk count but only 1 segment */ + .max_blk_count = UINT_MAX / TMIO_MAX_BLK_SIZE, .max_segs = 1, }; diff --git a/drivers/mmc/host/renesas_sdhi_sys_dmac.c b/drivers/mmc/host/renesas_sdhi_sys_dmac.c index 02cd878e209f..bfbf36634faa 100644 --- a/drivers/mmc/host/renesas_sdhi_sys_dmac.c +++ b/drivers/mmc/host/renesas_sdhi_sys_dmac.c @@ -65,7 +65,7 @@ static const struct renesas_sdhi_of_data of_rcar_gen2_compatible = { .scc_offset = 0x0300, .taps = rcar_gen2_scc_taps, .taps_num = ARRAY_SIZE(rcar_gen2_scc_taps), - .max_blk_count = 0xffffffff, + .max_blk_count = UINT_MAX / TMIO_MAX_BLK_SIZE, }; /* Definitions for sampling clocks */