]> git.dujemihanovic.xyz Git - u-boot.git/commit
mmc: Avoid buffer overrun in mmc_startup()
authorHeinrich Schuchardt <heinrich.schuchardt@canonical.com>
Thu, 4 Jan 2024 03:49:42 +0000 (04:49 +0100)
committerJaehoon Chung <jh80.chung@samsung.com>
Mon, 15 Apr 2024 06:19:11 +0000 (15:19 +0900)
commitf9a86fb118530fea5a87dd7f88e90c31c989043f
tree8568b92d2b805c9b3805dc6905510deaa1f57bcd
parentb03b49046af5dfca599d2ce8f0aafed89b97aa91
mmc: Avoid buffer overrun in mmc_startup()

If the CSD register contains a reserved value (4 - 7) in bits 0:2 of the
TRAN_SPEED field, a buffer overrun occurs. Resize the mapping table.

According to the original report
https://lore.kernel.org/u-boot/20180826231332.2491-11-erosca@de.adit-jv.com/
reserved values have been observed resulting in a buffer overrun.

Reported-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Fixes: 272cc70b211e ("Add MMC Framework")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
drivers/mmc/mmc.c