mmc: rtsx: check sg_count before long data xfer

Check sg_count before sending long data xfer.
Because dma_map_sg() return int, and sg_count may be negative,
so using int instead of unsigned.

Signed-off-by: Micky Ching <micky_ching@realsil.com.cn>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index b435806dd9f3e4bbb7a78925cfea2899de7e7f5f..1d3d6c4bfdc6800c8c97162f76a916d1c42f7401 100644 (file)
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -54,9 +54,9 @@ struct realtek_pci_sdmmc {
 #define SDMMC_POWER_ON         1
 #define SDMMC_POWER_OFF                0
 
-       unsigned int            sg_count;
+       int                     sg_count;
        s32                     cookie;
-       unsigned int            cookie_sg_count;
+       int                     cookie_sg_count;
        bool                    using_cookie;
 };
 
@@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
 {
        struct mmc_data *data = mrq->data;
 
+       if (host->sg_count < 0) {
+               data->error = host->sg_count;
+               dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
+                       __func__, host->sg_count);
+               return data->error;
+       }
+
        if (data->flags & MMC_DATA_READ)
                return sd_read_long_data(host, mrq);