diff options
| author | Micky Ching <micky_ching@realsil.com.cn> | 2015-01-14 03:09:12 (GMT) |
|---|---|---|
| committer | Ulf Hansson <ulf.hansson@linaro.org> | 2015-01-21 12:58:44 (GMT) |
| commit | be186ad5826ab6a06b585802dd5052d9674699ac (patch) | |
| tree | a6a6736f50aed83038ee9e871a6dd685c32f598f | |
| parent | b22217f966f585b69c823e0f525ee044e13d7976 (diff) | |
| download | linux-be186ad5826ab6a06b585802dd5052d9674699ac.tar.xz | |
mmc: rtsx: check sg_count before long data xfer
Check sg_count before sending long data xfer.
Because dma_map_sg() return int, and sg_count may be negative,
so using int instead of unsigned.
Signed-off-by: Micky Ching <micky_ching@realsil.com.cn>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
| -rw-r--r-- | drivers/mmc/host/rtsx_pci_sdmmc.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c index b435806..1d3d6c4 100644 --- a/drivers/mmc/host/rtsx_pci_sdmmc.c +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c @@ -54,9 +54,9 @@ struct realtek_pci_sdmmc { #define SDMMC_POWER_ON 1 #define SDMMC_POWER_OFF 0 - unsigned int sg_count; + int sg_count; s32 cookie; - unsigned int cookie_sg_count; + int cookie_sg_count; bool using_cookie; }; @@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) { struct mmc_data *data = mrq->data; + if (host->sg_count < 0) { + data->error = host->sg_count; + dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n", + __func__, host->sg_count); + return data->error; + } + if (data->flags & MMC_DATA_READ) return sd_read_long_data(host, mrq); |