Re: [PATCH] mmc: loongson2: Fix sg iteration in data reorder functions

On Tue, Aug 4, 2026 at 8:12=E2=80=AFAM Binbin Zhou <[email protected]>=
 wrote:
>
> In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(),
> the for_each_sg() macro already iterates over the scatterlist entries,
> with 'sg' pointing to the current entry. However, the code incorrectly
> uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, which treats
> 'sg' as an array base and indexes it again, leading to access of
> wrong sg entries (or out-of-bounds if the list is not an array).
>
> Cc: [email protected]
> Fixes: d0f8e961deae ("mmc: loongson2: Add Loongson-2K2000 SD/SDIO/eMMC co=
ntroller driver")
> Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller =
driver")
> Signed-off-by: Binbin Zhou <[email protected]>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/host/loongson2-mmc.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mmc/host/loongson2-mmc.c b/drivers/mmc/host/loongson=
2-mmc.c
> index f553e92fd9e5..118eccbaf8cd 100644
> --- a/drivers/mmc/host/loongson2-mmc.c
> +++ b/drivers/mmc/host/loongson2-mmc.c
> @@ -641,8 +641,8 @@ static void ls2k0500_mmc_reorder_cmd_data(struct loon=
gson2_mmc_host *host,
>                 return;
>
>         for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
> -               data =3D sg_virt(&sg[i]);
> -               for (j =3D 0; j < (sg_dma_len(&sg[i]) / 4); j++)
> +               data =3D sg_virt(sg);
> +               for (j =3D 0; j < (sg_dma_len(sg) / 4); j++)
>                         if (cmd->opcode =3D=3D SD_SWITCH)
>                                 data[j] =3D bitrev8x4(data[j]);
>                         else
> @@ -758,8 +758,8 @@ static void ls2k2000_mmc_reorder_cmd_data(struct loon=
gson2_mmc_host *host,
>                 return;
>
>         for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
> -               data =3D sg_virt(&sg[i]);
> -               for (j =3D 0; j < (sg_dma_len(&sg[i]) / 4); j++)
> +               data =3D sg_virt(sg);
> +               for (j =3D 0; j < (sg_dma_len(sg) / 4); j++)
>                         data[j] =3D bitrev8x4(data[j]);
>         }
>  }
>
> base-commit: e27c946b589c53520409a0956b33d52ef7a0898f
> --
> 2.52.0