diff options
| author | Ian Roberts <ian.roberts@timesys.com> | 2024-03-25 22:22:37 -0400 |
|---|---|---|
| committer | Jaehoon Chung <jh80.chung@samsung.com> | 2024-04-26 15:31:00 +0900 |
| commit | 5f0714496869b95e57a8b72192089e7df18c94cf (patch) | |
| tree | 0a8072fabf682c49393be7664258d6e5b2e4aad4 /include/sdhci.h | |
| parent | 74755c1fed1b09526b0993c729fe3ae909752fbd (diff) | |
mmc: sdhci: Fix potential ADMA descriptor table overflow
Change ADMA_TABLE_NO_ENTRIES to round the division up to fully
contain CONFIG_SYS_MMC_MAX_BLK_COUNT, fixing potential buffer overflow
of the ADMA descriptor table.
sdhci_prepare_adma_table() expecitily states it does _not_ check for
overflow as the descriptor table size is dependent on
CONFIG_SYS_MMC_MAX_BLK_COUNT. However, the ADMA_TABLE_NO_ENTRIES
calculation does not round up the divison, so with the current u-boot
defaults:
max_mmc_transfer = (CONFIG_SYS_MMC_MAX_BLK_COUNT * MMC_MAX_BLOCK_LEN) =
65535 * 512 = 33553920 bytes.
ADMA_TABLE_NO_ENTRIES = max_mmc_transfer / ADMA_MAX_LEN =
33553920 / 65532, which does not divide cleanly.
actual_max_transfer = ADMA_TABLE_NO_ENTRIES * ADMA_MAX_LEN = 512 *
65532 = 33552384, which is smaller than max_mmc_transfer.
This can cause sdhci_prepare_adma_table() to write one extra
descriptor, overflowing the table when a transaction larger than
actual_max_transfer is issued.
Co-developed-by: Nathan Barrett-Morrison <nathan.morrison@timesys.com>
Signed-off-by: Nathan Barrett-Morrison <nathan.morrison@timesys.com>
Signed-off-by: Greg Malysa <greg.malysa@timesys.com>
Signed-off-by: Ian Roberts <ian.roberts@timesys.com>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
Diffstat (limited to 'include/sdhci.h')
| -rw-r--r-- | include/sdhci.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/include/sdhci.h b/include/sdhci.h index d73a725609b..2dd13b4c714 100644 --- a/include/sdhci.h +++ b/include/sdhci.h @@ -11,6 +11,7 @@ #include <linux/bitops.h> #include <linux/types.h> +#include <linux/kernel.h> #include <asm/io.h> #include <mmc.h> #include <asm/gpio.h> @@ -304,8 +305,8 @@ struct sdhci_ops { #else #define ADMA_DESC_LEN 8 #endif -#define ADMA_TABLE_NO_ENTRIES (CONFIG_SYS_MMC_MAX_BLK_COUNT * \ - MMC_MAX_BLOCK_LEN) / ADMA_MAX_LEN +#define ADMA_TABLE_NO_ENTRIES DIV_ROUND_UP(CONFIG_SYS_MMC_MAX_BLK_COUNT * \ + MMC_MAX_BLOCK_LEN, ADMA_MAX_LEN) #define ADMA_TABLE_SZ (ADMA_TABLE_NO_ENTRIES * ADMA_DESC_LEN) |