Commit b5dd7985 authored by Chris Brandt's avatar Chris Brandt Committed by Greg Kroah-Hartman

mmc: tmio-mmc: fix bad pointer math

commit 9c284c41 upstream.

The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
number in bytes. A cast of buf should have been used.

However, instead of casting, just change the code to use u32 pointers.
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Fixes: 8185e51f: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by: default avatarChris Brandt <chris.brandt@renesas.com>
Reviewed-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Acked-by: default avatarWolfram Sang <wsa+renesas@sang-engineering.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 75791420
...@@ -404,30 +404,29 @@ static void tmio_mmc_transfer_data(struct tmio_mmc_host *host, ...@@ -404,30 +404,29 @@ static void tmio_mmc_transfer_data(struct tmio_mmc_host *host,
* Transfer the data * Transfer the data
*/ */
if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) { if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
u8 data[4] = { }; u32 data = 0;
u32 *buf32 = (u32 *)buf;
if (is_read) if (is_read)
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf, sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
count >> 2); count >> 2);
else else
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf, sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
count >> 2); count >> 2);
/* if count was multiple of 4 */ /* if count was multiple of 4 */
if (!(count & 0x3)) if (!(count & 0x3))
return; return;
buf8 = (u8 *)(buf + (count >> 2)); buf32 += count >> 2;
count %= 4; count %= 4;
if (is_read) { if (is_read) {
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, &data, 1);
(u32 *)data, 1); memcpy(buf32, &data, count);
memcpy(buf8, data, count);
} else { } else {
memcpy(data, buf8, count); memcpy(&data, buf32, count);
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, &data, 1);
(u32 *)data, 1);
} }
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment