summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMicky Ching <micky_ching@realsil.com.cn>2015-01-14 03:09:12 (GMT)
committerUlf Hansson <ulf.hansson@linaro.org>2015-01-21 12:58:44 (GMT)
commitbe186ad5826ab6a06b585802dd5052d9674699ac (patch)
treea6a6736f50aed83038ee9e871a6dd685c32f598f
parentb22217f966f585b69c823e0f525ee044e13d7976 (diff)
downloadlinux-be186ad5826ab6a06b585802dd5052d9674699ac.tar.xz
mmc: rtsx: check sg_count before long data xfer
Check sg_count before sending long data xfer. Because dma_map_sg() return int, and sg_count may be negative, so using int instead of unsigned. Signed-off-by: Micky Ching <micky_ching@realsil.com.cn> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-rw-r--r--drivers/mmc/host/rtsx_pci_sdmmc.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index b435806..1d3d6c4 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -54,9 +54,9 @@ struct realtek_pci_sdmmc {
#define SDMMC_POWER_ON 1
#define SDMMC_POWER_OFF 0
- unsigned int sg_count;
+ int sg_count;
s32 cookie;
- unsigned int cookie_sg_count;
+ int cookie_sg_count;
bool using_cookie;
};
@@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
{
struct mmc_data *data = mrq->data;
+ if (host->sg_count < 0) {
+ data->error = host->sg_count;
+ dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
+ __func__, host->sg_count);
+ return data->error;
+ }
+
if (data->flags & MMC_DATA_READ)
return sd_read_long_data(host, mrq);