From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:44026 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753805AbeCFStX (ORCPT ); Tue, 6 Mar 2018 13:49:23 -0500 Subject: Patch "mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias" has been added to the 4.14-stable tree To: geert+renesas@glider.be, gregkh@linuxfoundation.org, shawn.lin@rock-chips.com, stable@vger.kernel.org, ulf.hansson@linaro.org Cc: , From: Date: Tue, 06 Mar 2018 10:49:02 -0800 Message-ID: <152036214214981@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mmc-dw_mmc-k3-fix-out-of-bounds-access-through-dt-alias.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 325501d9360eb42c7c51e6daa0d733844c1e790b Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Fri, 23 Feb 2018 13:44:19 +0100 Subject: mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias From: Geert Uytterhoeven commit 325501d9360eb42c7c51e6daa0d733844c1e790b upstream. The hs_timing_cfg[] array is indexed using a value derived from the "mshcN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 361c7fe9b02eee7e ("mmc: dw_mmc-k3: add sd support for hi3660") Signed-off-by: Geert Uytterhoeven Reviewed-by: Shawn Lin Cc: Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman --- drivers/mmc/host/dw_mmc-k3.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/mmc/host/dw_mmc-k3.c +++ b/drivers/mmc/host/dw_mmc-k3.c @@ -135,6 +135,9 @@ static int dw_mci_hi6220_parse_dt(struct if (priv->ctrl_id < 0) priv->ctrl_id = 0; + if (priv->ctrl_id >= TIMING_MODE) + return -EINVAL; + host->priv = priv; return 0; } Patches currently in stable-queue which might be from geert+renesas@glider.be are queue-4.14/mmc-dw_mmc-fix-out-of-bounds-access-for-slot-s-caps.patch queue-4.14/mmc-dw_mmc-k3-fix-out-of-bounds-access-through-dt-alias.patch