From: Peng Fan <[email protected]> In rpmb_route_frames(), the RPMB_REQ_READ_DATA case checks "req_cnt != 1 || !req_cnt" which is tautological -- !req_cnt (req_cnt == 0) is always a subset of req_cnt != 1. The second operand is dead code.
Based on the pattern of all other cases in the switch (RPMB_REQ_KEY, RPMB_REQ_WRITE_DATA, RPMB_REQ_WCOUNTER) which validate rsp_cnt, this was meant to be "req_cnt != 1 || !rsp_cnt". Without this fix, a caller could pass rsp_cnt=0 for a read request without validation. Signed-off-by: Peng Fan <[email protected]> --- drivers/mmc/rpmb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/rpmb.c b/drivers/mmc/rpmb.c index 8bfdffd56f5..26d2262ef45 100644 --- a/drivers/mmc/rpmb.c +++ b/drivers/mmc/rpmb.c @@ -452,7 +452,7 @@ static int rpmb_route_frames(struct mmc *mmc, struct s_rpmb *req, return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt); case RPMB_REQ_READ_DATA: - if (req_cnt != 1 || !req_cnt) + if (req_cnt != 1 || !rsp_cnt) return -EINVAL; return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt); -- 2.51.0
