From: Lei Wen <leiwen@marvell.com>
Date: Mon, 13 Sep 2010 14:07:27 +0000 (+0800)
Subject: mmc: add boundary check for mmc operation
X-Git-Tag: v2010.09-rc2~8
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=d2bf29e3994688ce730c8ab82bbafe6e39c229c1;p=u-boot

mmc: add boundary check for mmc operation

Signed-off-by: Lei Wen <leiwen@marvell.com>
---

diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index cf4ea161b9..23928c1356 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -92,6 +92,11 @@ mmc_bwrite(int dev_num, ulong start, lbaint_t blkcnt, const void*src)
 
 	blklen = mmc->write_bl_len;
 
+	if ((start + blkcnt) > mmc->block_dev.lba) {
+		printf("MMC: block number 0x%x exceeds max(0x%x)",
+			start + blkcnt, mmc->block_dev.lba);
+		return 0;
+	}
 	err = mmc_set_blocklen(mmc, mmc->write_bl_len);
 
 	if (err) {
@@ -219,6 +224,11 @@ static ulong mmc_bread(int dev_num, ulong start, lbaint_t blkcnt, void *dst)
 	if (!mmc)
 		return 0;
 
+	if ((start + blkcnt) > mmc->block_dev.lba) {
+		printf("MMC: block number 0x%x exceeds max(0x%x)",
+			start + blkcnt, mmc->block_dev.lba);
+		return 0;
+	}
 	/* We always do full block reads from the card */
 	err = mmc_set_blocklen(mmc, mmc->read_bl_len);