From: Micky Ching <micky_ching@realsil.com.cn>
Date: Wed, 14 Jan 2015 03:09:12 +0000 (+0800)
Subject: mmc: rtsx: check sg_count before long data xfer
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=be186ad5826ab6a06b585802dd5052d9674699ac;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

mmc: rtsx: check sg_count before long data xfer

Check sg_count before sending long data xfer.
Because dma_map_sg() return int, and sg_count may be negative,
so using int instead of unsigned.

Signed-off-by: Micky Ching <micky_ching@realsil.com.cn>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
---

diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index b435806dd9f3..1d3d6c4bfdc6 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -54,9 +54,9 @@ struct realtek_pci_sdmmc {
 #define SDMMC_POWER_ON		1
 #define SDMMC_POWER_OFF		0
 
-	unsigned int		sg_count;
+	int			sg_count;
 	s32			cookie;
-	unsigned int		cookie_sg_count;
+	int			cookie_sg_count;
 	bool			using_cookie;
 };
 
@@ -557,6 +557,13 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
 {
 	struct mmc_data *data = mrq->data;
 
+	if (host->sg_count < 0) {
+		data->error = host->sg_count;
+		dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
+			__func__, host->sg_count);
+		return data->error;
+	}
+
 	if (data->flags & MMC_DATA_READ)
 		return sd_read_long_data(host, mrq);