RE: [PATCH v2] mmc: tmio-mmc: fix bad pointer math

[Chris Brandt]

Hi Geert,

On Wednesday, July 12, 2017 1, Geert Uytterhoeven wrote:
> > Reported-by: Dan Carpenter 
> > Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
> > Signed-off-by: Chris Brandt 
> 
> Reviewed-by: Geert Uytterhoeven 


As always, thank you for your review.


> > if (is_read) {
> > sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
> > -  (u32 *)data, 1);
> > +  &data, 1);
> 
> I would use the opportunity to merge the two above lines, now they fit
> on a single line.
> 
> > +   memcpy(buf32, &data, count);
> > } else {
> > -   memcpy(data, buf8, count);
> > +   memcpy(&data, buf32, count);
> > sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
> > -   (u32 *)data, 1);
> > +   &data, 1);
> 
> Likewise.

Easy enough.

Done!


Thanks,
Chris

Re: [PATCH v2] mmc: tmio-mmc: fix bad pointer math

[Geert Uytterhoeven]

On Wed, Jul 12, 2017 at 3:27 PM, Chris Brandt  wrote:
> The existing code gives an incorrect pointer value.
> The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
> number in bytes. A cast of buf should have been used.
>
> However,instead of casting, just change the code to use u32 pointers.
>
> Reported-by: Dan Carpenter 
> Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
> Signed-off-by: Chris Brandt 

Reviewed-by: Geert Uytterhoeven 

> --- a/drivers/mmc/host/tmio_mmc_core.c
> +++ b/drivers/mmc/host/tmio_mmc_core.c

> if (is_read) {
> sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
> -  (u32 *)data, 1);
> +  &data, 1);

I would use the opportunity to merge the two above lines, now they fit
on a single line.

> +   memcpy(buf32, &data, count);
> } else {
> -   memcpy(data, buf8, count);
> +   memcpy(&data, buf32, count);
> sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
> -   (u32 *)data, 1);
> +   &data, 1);

Likewise.

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

[PATCH v2] mmc: tmio-mmc: fix bad pointer math

[Chris Brandt]

The existing code gives an incorrect pointer value.
The buffer pointer 'buf' was of type unsigned short *, and 'count' was a
number in bytes. A cast of buf should have been used.

However,instead of casting, just change the code to use u32 pointers.

Reported-by: Dan Carpenter 
Fixes: 8185e51f358a: ("mmc: tmio-mmc: add support for 32bit data port")
Signed-off-by: Chris Brandt 
---
v2:
 * Use u32 pointers instead of casting
---
 drivers/mmc/host/tmio_mmc_core.c | 17 +
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 77e7b56a9099..e4e35b6e2db5 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -415,30 +415,31 @@ static void tmio_mmc_transfer_data(struct tmio_mmc_host 
*host,
 * Transfer the data
 */
if (host->pdata->flags & TMIO_MMC_32BIT_DATA_PORT) {
-   u8 data[4] = { };
+   u32 data = 0;
+   u32 *buf32 = (u32 *)buf;
 
if (is_read)
-   sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+   sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT, buf32,
   count >> 2);
else
-   sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, (u32 *)buf,
+   sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT, buf32,
count >> 2);
 
/* if count was multiple of 4 */
if (!(count & 0x3))
return;
 
-   buf8 = (u8 *)(buf + (count >> 2));
+   buf32 += count >> 2;
count %= 4;
 
if (is_read) {
sd_ctrl_read32_rep(host, CTL_SD_DATA_PORT,
-  (u32 *)data, 1);
-   memcpy(buf8, data, count);
+  &data, 1);
+   memcpy(buf32, &data, count);
} else {
-   memcpy(data, buf8, count);
+   memcpy(&data, buf32, count);
sd_ctrl_write32_rep(host, CTL_SD_DATA_PORT,
-   (u32 *)data, 1);
+   &data, 1);
}
 
return;
-- 
2.13.0