diff options
| author | Peng Fan <[email protected]> | 2026-07-13 21:32:53 +0800 |
|---|---|---|
| committer | Peng Fan <[email protected]> | 2026-07-29 11:15:55 +0800 |
| commit | 67d06fe102712dc07e05bbdf893fc48ba73c86a6 (patch) | |
| tree | d97bd924efdf4266fd080342f3df5b8745bdce6c | |
| parent | f23b5e079a93245c01f618022fd76d189070d190 (diff) | |
mmc: rpmb: fix tautological condition in RPMB_REQ_READ_DATA validation
In rpmb_route_frames(), the RPMB_REQ_READ_DATA case checks
"req_cnt != 1 || !req_cnt" which is tautological -- !req_cnt (req_cnt
== 0) is always a subset of req_cnt != 1. The second operand is dead
code.
Based on the pattern of all other cases in the switch (RPMB_REQ_KEY,
RPMB_REQ_WRITE_DATA, RPMB_REQ_WCOUNTER) which validate rsp_cnt, this
was meant to be "req_cnt != 1 || !rsp_cnt". Without this fix, a caller
could pass rsp_cnt=0 for a read request without validation.
Signed-off-by: Peng Fan <[email protected]>
| -rw-r--r-- | drivers/mmc/rpmb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mmc/rpmb.c b/drivers/mmc/rpmb.c index 8bfdffd56f5..26d2262ef45 100644 --- a/drivers/mmc/rpmb.c +++ b/drivers/mmc/rpmb.c @@ -452,7 +452,7 @@ static int rpmb_route_frames(struct mmc *mmc, struct s_rpmb *req, return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt); case RPMB_REQ_READ_DATA: - if (req_cnt != 1 || !req_cnt) + if (req_cnt != 1 || !rsp_cnt) return -EINVAL; return rpmb_route_read_req(mmc, req, req_cnt, rsp, rsp_cnt); |