Re: [patch 077/232] sdio: fix read buffer overflow

[David Vrabel <david.vrabel@csr.com>]

[-- Attachment #1: Type: text/plain, Size: 674 bytes --]

David Vrabel wrote:
> 
> It's harmless if the tuple contains fewer so I think we should just try
> and parse as many strings as possible.  Does this patch fix your regression?

I spelt the field name wrong in the comment.  Use this patch instead,
please.

David
-- 
David Vrabel, Senior Software Engineer, Drivers
CSR, Churchill House, Cambridge Business Park,  Tel: +44 (0)1223 692562
Cowley Road, Cambridge, CB4 0WZ                 http://www.csr.com/


Member of the CSR plc group of companies. CSR plc registered in England and Wales, registered number 4187346, registered office Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom

[-- Attachment #2: 0001-mmc-sdio-don-t-require-CISTPL_VERS_1-to-contain-4-st.patch --]
[-- Type: text/x-diff, Size: 1318 bytes --]

>From 41dc65a6198d2852a586ec0032fd5e03038fa32f Mon Sep 17 00:00:00 2001
From: David Vrabel <david.vrabel@csr.com>
Date: Thu, 1 Oct 2009 11:56:25 +0100
Subject: [PATCH] mmc: sdio: don't require CISTPL_VERS_1 to contain 4 strings

The PC Card 8.0 specification (vol. 4, section 3.2.10) says the
TPLLV1_INFO field of the CISTPL_VERS_1 tuple must contain 4 strings.
Some cards don't have all 4 so just parse as many as we can.

Signed-off-by: David Vrabel <david.vrabel@csr.com>
---
 drivers/mmc/core/sdio_cis.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index 6636354..e5ab44d 100644
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -29,6 +29,8 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
 	unsigned i, nr_strings;
 	char **buffer, *string;
 
+	/* Find all null-terminated (including zero length) strings in
+	   the TPLLV1_INFO field. Trailing garbage is ignored. */
 	buf += 2;
 	size -= 2;
 
@@ -39,9 +41,7 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
 		if (buf[i] == 0)
 			nr_strings++;
 	}
-
-	if (nr_strings < 4) {
-		printk(KERN_WARNING "SDIO: ignoring broken CISTPL_VERS_1\n");
+	if (nr_strings == 0) {
 		return 0;
 	}
 
-- 
1.6.3.3