DF-2480
daddr_t (int32) truncation of block address for >1TB MMC/SD media
Summary
mmcsd_rw and mmcsd_delete declare block/end as daddr_t which is __int32_t. For SDXC/large eMMC beyond 2^31 sectors (~1TiB at 512B) bio->bio_offset/sz silently truncates to possibly-negative 32-bit value producing wrong MMC command arguments and depending on card behavior either spurious EIO or data corruption at wrong sector. block=bio->bio_offset/sz assignment truncates to int32. cmd.arg=block reinterprets negative as uint32 0xFFFFFFFF sent to card. Affects mmcsd_delete too.
No comments yet.