diff options
| author | Pierre Ossman <drzeus@drzeus.cx> | 2009-03-05 19:40:27 +0100 |
|---|---|---|
| committer | Pierre Ossman <drzeus@drzeus.cx> | 2009-03-24 21:30:00 +0100 |
| commit | be6f19fc24c937112d251232b3dae7e05e96aad1 (patch) | |
| tree | d7c94b0b797e0f1f84c903c0101b29ef025460fd /drivers/mmc | |
| parent | c8d718f1037950107f13607ff0b696ffe63df76a (diff) | |
| download | kernel_samsung_tuna-be6f19fc24c937112d251232b3dae7e05e96aad1.zip kernel_samsung_tuna-be6f19fc24c937112d251232b3dae7e05e96aad1.tar.gz kernel_samsung_tuna-be6f19fc24c937112d251232b3dae7e05e96aad1.tar.bz2 | |
sdio: check that addresses are within the address space
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Diffstat (limited to 'drivers/mmc')
| -rw-r--r-- | drivers/mmc/core/sdio_ops.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/mmc/core/sdio_ops.c b/drivers/mmc/core/sdio_ops.c index c8fa095..4eb7825 100644 --- a/drivers/mmc/core/sdio_ops.c +++ b/drivers/mmc/core/sdio_ops.c @@ -76,6 +76,10 @@ int mmc_io_rw_direct(struct mmc_card *card, int write, unsigned fn, BUG_ON(!card); BUG_ON(fn > 7); + /* sanity check */ + if (addr & ~0x1FFFF) + return -EINVAL; + memset(&cmd, 0, sizeof(struct mmc_command)); cmd.opcode = SD_IO_RW_DIRECT; @@ -125,6 +129,10 @@ int mmc_io_rw_extended(struct mmc_card *card, int write, unsigned fn, WARN_ON(blocks == 0); WARN_ON(blksz == 0); + /* sanity check */ + if (addr & ~0x1FFFF) + return -EINVAL; + memset(&mrq, 0, sizeof(struct mmc_request)); memset(&cmd, 0, sizeof(struct mmc_command)); memset(&data, 0, sizeof(struct mmc_data)); |