summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLei Wen <leiwen@marvell.com>2010-09-13 22:07:27 +0800
committerWolfgang Denk <wd@denx.de>2010-09-18 23:46:24 +0200
commitd2bf29e3994688ce730c8ab82bbafe6e39c229c1 (patch)
treeab4c06ef5ad6093be7b1fe1f87c3b67cc9ade52d
parenta12555c02d716f62aa1ec4764cf1c42bfeecf07d (diff)
downloadu-boot-imx-d2bf29e3994688ce730c8ab82bbafe6e39c229c1.zip
u-boot-imx-d2bf29e3994688ce730c8ab82bbafe6e39c229c1.tar.gz
u-boot-imx-d2bf29e3994688ce730c8ab82bbafe6e39c229c1.tar.bz2
mmc: add boundary check for mmc operation
Signed-off-by: Lei Wen <leiwen@marvell.com>
-rw-r--r--drivers/mmc/mmc.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index cf4ea16..23928c1 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -92,6 +92,11 @@ mmc_bwrite(int dev_num, ulong start, lbaint_t blkcnt, const void*src)
blklen = mmc->write_bl_len;
+ if ((start + blkcnt) > mmc->block_dev.lba) {
+ printf("MMC: block number 0x%x exceeds max(0x%x)",
+ start + blkcnt, mmc->block_dev.lba);
+ return 0;
+ }
err = mmc_set_blocklen(mmc, mmc->write_bl_len);
if (err) {
@@ -219,6 +224,11 @@ static ulong mmc_bread(int dev_num, ulong start, lbaint_t blkcnt, void *dst)
if (!mmc)
return 0;
+ if ((start + blkcnt) > mmc->block_dev.lba) {
+ printf("MMC: block number 0x%x exceeds max(0x%x)",
+ start + blkcnt, mmc->block_dev.lba);
+ return 0;
+ }
/* We always do full block reads from the card */
err = mmc_set_blocklen(mmc, mmc->read_bl_len);