mmc: sdhci-msm: Fix array-index-out-of-bounds

INVALID_TUNING_PHASE is defined to -1 but saved_tuning_phase is defined
as an unsigned integer. This causes the following UBSAN warning:

[    1.150177] UBSAN: Undefined behaviour in ../../../../../../kernel/xiaomi/sm6250/drivers/mmc/host/sdhci-msm.c:542:2
[    1.150180] index 255 is out of range for type 'u8 [16]'
[    1.150185] CPU: 6 PID: 87 Comm: kworker/6:1 Tainted: G S              4.14.190-lineageos-ge44e3bc2e-dirty #17
[    1.150187] Hardware name: Qualcomm Technologies, Inc. ATOLL-AB PM6150 wcd937x Audio Codec AB IDP CURTANA (DT)
[    1.150196] Workqueue: events_freezable mmc_rescan
[    1.150199] Call trace:
[    1.150204] dump_backtrace+0x0/0x1d0
[    1.150208] show_stack+0x18/0x24
[    1.150213] dump_stack+0xd8/0x114
[    1.150217] __ubsan_handle_out_of_bounds+0xc8/0x104
[    1.150220] msm_config_cm_dll_phase+0x238/0x248
[    1.150222] sdhci_msm_execute_tuning+0x2a0/0xb24
[    1.150225] sdhci_execute_tuning+0xcc/0x6c0
[    1.150228] mmc_execute_tuning+0x6c/0xc0
[    1.150230] mmc_sd_init_card+0x62c/0x6e0
[    1.150233] mmc_attach_sd+0xbc/0x2cc
[    1.150235] mmc_rescan+0x2ac/0x3a4
[    1.150239] process_one_work+0x260/0x45c
[    1.150241] worker_thread+0x258/0x494
[    1.150244] kthread+0x11c/0x12c
[    1.150247] ret_from_fork+0x10/0x18

Fix it by changing the saved_tuning_phase definition to a signed integer.

Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Change-Id: I9f53d4c7a7a543e77f6538253c485af61c0e7684
fourteen
Ivan Vecera 3 years ago committed by Simon1511
parent 3ad8b54cb0
commit 894986ad1b
  1. 2
      drivers/mmc/host/sdhci-msm.h

@ -237,7 +237,7 @@ struct sdhci_msm_host {
u32 clk_rate; /* Keeps track of current clock rate that is set */
bool tuning_done;
bool calibration_done;
u8 saved_tuning_phase;
int saved_tuning_phase;
bool en_auto_cmd21;
struct device_attribute auto_cmd21_attr;
bool is_sdiowakeup_enabled;

Loading…
Cancel
Save