diff options
| author | Geert Uytterhoeven <geert+renesas@glider.be> | 2018-02-23 15:44:19 +0300 |
|---|---|---|
| committer | Ulf Hansson <ulf.hansson@linaro.org> | 2018-02-27 17:11:06 +0300 |
| commit | 325501d9360eb42c7c51e6daa0d733844c1e790b (patch) | |
| tree | 2bbdfee9413b755238973c4226abb06c27584bfa /drivers/mmc | |
| parent | f8870ae6e2d6be75b1accc2db981169fdfbea7ab (diff) | |
| download | linux-325501d9360eb42c7c51e6daa0d733844c1e790b.tar.xz | |
mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
The hs_timing_cfg[] array is indexed using a value derived from the
"mshcN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 361c7fe9b02eee7e ("mmc: dw_mmc-k3: add sd support for hi3660")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Diffstat (limited to 'drivers/mmc')
| -rw-r--r-- | drivers/mmc/host/dw_mmc-k3.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/mmc/host/dw_mmc-k3.c b/drivers/mmc/host/dw_mmc-k3.c index 73fd75c3c824..75ae5803b0db 100644 --- a/drivers/mmc/host/dw_mmc-k3.c +++ b/drivers/mmc/host/dw_mmc-k3.c @@ -135,6 +135,9 @@ static int dw_mci_hi6220_parse_dt(struct dw_mci *host) if (priv->ctrl_id < 0) priv->ctrl_id = 0; + if (priv->ctrl_id >= TIMING_MODE) + return -EINVAL; + host->priv = priv; return 0; } |