From: Ian Roberts Date: Tue, 26 Mar 2024 02:22:37 +0000 (-0400) Subject: mmc: sdhci: Fix potential ADMA descriptor table overflow X-Git-Url: http://git.dujemihanovic.xyz/%22http:/www.sics.se/static/%7B%7B%20%24style.Permalink%20%7D%7D?a=commitdiff_plain;h=5f0714496869b95e57a8b72192089e7df18c94cf;p=u-boot.git mmc: sdhci: Fix potential ADMA descriptor table overflow Change ADMA_TABLE_NO_ENTRIES to round the division up to fully contain CONFIG_SYS_MMC_MAX_BLK_COUNT, fixing potential buffer overflow of the ADMA descriptor table. sdhci_prepare_adma_table() expecitily states it does _not_ check for overflow as the descriptor table size is dependent on CONFIG_SYS_MMC_MAX_BLK_COUNT. However, the ADMA_TABLE_NO_ENTRIES calculation does not round up the divison, so with the current u-boot defaults: max_mmc_transfer = (CONFIG_SYS_MMC_MAX_BLK_COUNT * MMC_MAX_BLOCK_LEN) = 65535 * 512 = 33553920 bytes. ADMA_TABLE_NO_ENTRIES = max_mmc_transfer / ADMA_MAX_LEN = 33553920 / 65532, which does not divide cleanly. actual_max_transfer = ADMA_TABLE_NO_ENTRIES * ADMA_MAX_LEN = 512 * 65532 = 33552384, which is smaller than max_mmc_transfer. This can cause sdhci_prepare_adma_table() to write one extra descriptor, overflowing the table when a transaction larger than actual_max_transfer is issued. Co-developed-by: Nathan Barrett-Morrison Signed-off-by: Nathan Barrett-Morrison Signed-off-by: Greg Malysa Signed-off-by: Ian Roberts Reviewed-by: Jaehoon Chung --- diff --git a/include/sdhci.h b/include/sdhci.h index d73a725609..2dd13b4c71 100644 --- a/include/sdhci.h +++ b/include/sdhci.h @@ -11,6 +11,7 @@ #include #include +#include #include #include #include @@ -304,8 +305,8 @@ struct sdhci_ops { #else #define ADMA_DESC_LEN 8 #endif -#define ADMA_TABLE_NO_ENTRIES (CONFIG_SYS_MMC_MAX_BLK_COUNT * \ - MMC_MAX_BLOCK_LEN) / ADMA_MAX_LEN +#define ADMA_TABLE_NO_ENTRIES DIV_ROUND_UP(CONFIG_SYS_MMC_MAX_BLK_COUNT * \ + MMC_MAX_BLOCK_LEN, ADMA_MAX_LEN) #define ADMA_TABLE_SZ (ADMA_TABLE_NO_ENTRIES * ADMA_DESC_LEN)