From be186ad5826ab6a06b585802dd5052d9674699ac Mon Sep 17 00:00:00 2001 From: Micky Ching Date: Wed, 14 Jan 2015 11:09:12 +0800 Subject: [PATCH] mmc: rtsx: check sg_count before long data xfer Check sg_count before sending long data xfer. Because dma_map_sg() return int, and sg_count may be negative, so using int instead of unsigned. Signed-off-by: Micky Ching Signed-off-by: Ulf Hansson --- drivers/mmc/host/rtsx_pci_sdmmc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c index b435806dd9f3..1d3d6c4bfdc6 100644 --- a/drivers/mmc/host/rtsx_pci_sdmmc.c +++ b/drivers/mmc/host/rtsx_pci_sdmmc.c @@ -54,9 +54,9 @@ struct realtek_pci_sdmmc { #define SDMMC_POWER_ON 1 #define SDMMC_POWER_OFF 0 - unsigned int sg_count; + int sg_count; s32 cookie; - unsigned int cookie_sg_count; + int cookie_sg_count; bool using_cookie; }; @@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) { struct mmc_data *data = mrq->data; + if (host->sg_count < 0) { + data->error = host->sg_count; + dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n", + __func__, host->sg_count); + return data->error; + } + if (data->flags & MMC_DATA_READ) return sd_read_long_data(host, mrq); -- 2.11.0