From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eugeniu Rosca Date: Mon, 20 Aug 2018 02:00:31 +0200 Subject: [U-Boot] [PATCH 7/8] mmc: Fix read-past-end-of-array undefined behavior In-Reply-To: <20180820000033.25519-1-erosca@de.adit-jv.com> References: <20180820000033.25519-1-erosca@de.adit-jv.com> Message-ID: <20180820000033.25519-8-erosca@de.adit-jv.com> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Running "mmc dev 0" on R-Car H3 Salvator-X (CONFIG_UBSAN=y) occasionally results in: => mmc dev 0 ================================================================= UBSAN: Undefined behaviour in drivers/mmc/mmc.c:2233:14 index 7 is out of range for type 'int [4]' ================================================================= Currently, fbase[] array consists of 4 elements: -------8<------- static const int fbase[] = { 10000, 100000, 1000000, 10000000, }; -------8<------- Adjust the mask used to compute the fbase[] index accordingly. Fixes: 272cc70b211e ("Add MMC Framework") Signed-off-by: Eugeniu Rosca --- drivers/mmc/mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c index 447519f46f15..01da99edb084 100644 --- a/drivers/mmc/mmc.c +++ b/drivers/mmc/mmc.c @@ -2230,7 +2230,7 @@ static int mmc_startup(struct mmc *mmc) } /* divide frequency by 10, since the mults are 10x bigger */ - freq = fbase[(cmd.response[0] & 0x7)]; + freq = fbase[(cmd.response[0] & 0x3)]; mult = multipliers[((cmd.response[0] >> 3) & 0xf)]; mmc->legacy_speed = freq * mult; -- 2.18.0