[PATCH 3/4] mci: core: remove broken, unneeded write bounce buffer

[Ahmad Fatoum]

mci_block_write uses a 512-byte long bounce buffer if the src argument
is not 4-byte aligned. This can never happen as src is the address of a
block cache chunk, which is always aligned for DMA, which is always a
multiple of 4 bytes. Furthermore, the bounce buffer is just a single
sector and the function may write multiple blocks resulting in
out-of-bounds read if that code hadn't been dead.

Signed-off-by: Ahmad Fatoum <a.fat...@pengutronix.de>
---
 drivers/mci/mci-core.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/mci/mci-core.c b/drivers/mci/mci-core.c
index 07eca96a9d61..280d08eb6253 100644
--- a/drivers/mci/mci-core.c
+++ b/drivers/mci/mci-core.c
@@ -218,7 +218,6 @@ static int mci_block_write(struct mci *mci, const void 
*src, int blocknum,
 {
        struct mci_cmd cmd;
        struct mci_data data;
-       const void *buf;
        unsigned mmccmd;
        int ret;
 
@@ -238,19 +237,12 @@ static int mci_block_write(struct mci *mci, const void 
*src, int blocknum,
        else
                mmccmd = MMC_CMD_WRITE_SINGLE_BLOCK;
 
-       if ((unsigned long)src & 0x3) {
-               memcpy(sector_buf, src, SECTOR_SIZE);
-               buf = sector_buf;
-       } else {
-               buf = src;
-       }
-
        mci_setup_cmd(&cmd,
                mmccmd,
                mci->high_capacity != 0 ? blocknum : blocknum * 
mci->write_bl_len,
                MMC_RSP_R1);
 
-       data.src = buf;
+       data.src = src;
        data.blocks = blocks;
        data.blocksize = mci->write_bl_len;
        data.flags = MMC_DATA_WRITE;
-- 
2.39.2