kernel.git/drivers/mmc/core, branch linux-5.7.y

mmc: sdio: Fix several potential memory leaks in mmc_sdio_init_card()

2020-06-17T14:43:04Z

commit a94a59f43749b4f8cd81b8be87c95f9ef898d19d upstream. Over the years, the code in mmc_sdio_init_card() has grown to become quite messy. Unfortunate this has also lead to that several paths are leaking memory in form of an allocated struct mmc_card, which includes additional data, such as initialized struct device for example. Unfortunate, it's a too complex task find each offending commit. Therefore, this change fixes all memory leaks at once. Cc: Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200430091640.455-3-ulf.hansson@linaro.org Signed-off-by: Greg Kroah-Hartman

mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card()

2020-06-17T14:43:04Z

commit f04086c225da11ad16d7f9a2fbca6483ab16dded upstream. During some scenarios mmc_sdio_init_card() runs a retry path for the UHS-I specific initialization, which leads to removal of the previously allocated card. A new card is then re-allocated while retrying. However, in one of the corresponding error paths we may end up to remove an already removed card, which likely leads to a NULL pointer exception. So, let's fix this. Fixes: 5fc3d80ef496 ("mmc: sdio: don't use rocr to check if the card could support UHS mode") Cc: Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200430091640.455-2-ulf.hansson@linaro.org Signed-off-by: Greg Kroah-Hartman

mmc: block: Fix use-after-free issue for rpmb

2020-05-25T08:45:17Z

The data structure member “rpmb->md” was passed to a call of the function “mmc_blk_put” after a call of the function “put_device”. Reorder these function calls to keep the data accesses consistent. Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ") Signed-off-by: Peng Hao Cc: stable@vger.kernel.org [Uffe: Fixed up mangled patch and updated commit message] Signed-off-by: Ulf Hansson

mmc: block: Fix request completion in the CQE timeout path

2020-05-08T08:15:51Z

First, it should be noted that the CQE timeout (60 seconds) is substantial so a CQE request that times out is really stuck, and the race between timeout and completion is extremely unlikely. Nevertheless this patch fixes an issue with it. Commit ad73d6feadbd7b ("mmc: complete requests from ->timeout") preserved the existing functionality, to complete the request. However that had only been necessary because the block layer timeout handler had been marking the request to prevent it from being completed normally. That restriction was removed at the same time, the result being that a request that has gone will have been completed anyway. That is, the completion was unnecessary. At the time, the unnecessary completion was harmless because the block layer would ignore it, although that changed in kernel v5.0. Note for stable, this patch will not apply cleanly without patch "mmc: core: Fix recursive locking issue in CQE recovery path" Signed-off-by: Adrian Hunter Fixes: ad73d6feadbd7b ("mmc: complete requests from ->timeout") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200508062227.23144-1-adrian.hunter@intel.com Signed-off-by: Ulf Hansson

mmc: core: Fix recursive locking issue in CQE recovery path

2020-05-08T05:30:11Z

Consider the following stack trace -001|raw_spin_lock_irqsave -002|mmc_blk_cqe_complete_rq -003|__blk_mq_complete_request(inline) -003|blk_mq_complete_request(rq) -004|mmc_cqe_timed_out(inline) -004|mmc_mq_timed_out mmc_mq_timed_out acquires the queue_lock for the first time. The mmc_blk_cqe_complete_rq function also tries to acquire the same queue lock resulting in recursive locking where the task is spinning for the same lock which it has already acquired leading to watchdog bark. Fix this issue with the lock only for the required critical section. Cc: Fixes: 1e8e55b67030 ("mmc: block: Add CQE support") Suggested-by: Sahitya Tummala Signed-off-by: Sarthak Garg Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1588868135-31783-1-git-send-email-vbadigan@codeaurora.org Signed-off-by: Ulf Hansson

mmc: core: Check request type before completing the request

2020-05-08T05:30:05Z

In the request completion path with CQE, request type is being checked after the request is getting completed. This is resulting in returning the wrong request type and leading to the IO hang issue. ASYNC request type is getting returned for DCMD type requests. Because of this mismatch, mq->cqe_busy flag is never getting cleared and the driver is not invoking blk_mq_hw_run_queue. So requests are not getting dispatched to the LLD from the block layer. All these eventually leading to IO hang issues. So, get the request type before completing the request. Cc: Fixes: 1e8e55b67030 ("mmc: block: Add CQE support") Signed-off-by: Veerabhadrarao Badiganti Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1588775643-18037-2-git-send-email-vbadigan@codeaurora.org Signed-off-by: Ulf Hansson

mmc: core: make mmc_interrupt_hpi() static

2020-04-20T07:24:39Z

Fix the following sparse warning: drivers/mmc/core/mmc_ops.c:881:5: warning: symbol 'mmc_interrupt_hpi' was not declared. Should it be static? Reported-by: Hulk Robot Signed-off-by: Jason Yan Fixes: 55c2b8b9a383 ("mmc: core: Re-work the code for eMMC sanitize") Link: https://lore.kernel.org/r/20200403034727.11879-1-yanaijie@huawei.com Signed-off-by: Ulf Hansson

mmc: core: Re-work the code for eMMC sanitize

2020-03-26T13:45:31Z

The error path for sanitize operations that completes with -ETIMEDOUT, is tightly coupled with the internal request handling code of the core. More precisely, mmc_wait_for_req_done() checks for specific sanitize errors. This is not only inefficient as it affects all types of requests, but also hackish. Therefore, let's improve the behaviour by moving the error path out of the mmc core. To do that, retuning needs to be held while running the sanitize operation. Moreover, to avoid exporting unnecessary symbols to the mmc block module, let's move the code into the mmc_ops.c file. While updating the actual code, let's also take the opportunity to clean up some of the mess around it. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200316152152.15122-1-ulf.hansson@linaro.org

mmc: mmc_test: Pass different sg lists for non-blocking requests

2020-03-24T13:35:42Z

Supply a separate sg list for each of the request in non-blocking IO test cases where two requests will be issued at same time. Otherwise, sg memory may get unmapped when a request is done while same memory is being accessed by controller from the other request, and it leads to iommu errors with below call stack: __arm_lpae_unmap+0x2e0/0x478 arm_lpae_unmap+0x54/0x70 arm_smmu_unmap+0x64/0xa4 __iommu_unmap+0xb8/0x1f0 iommu_unmap_fast+0x38/0x48 __iommu_dma_unmap+0x88/0x108 iommu_dma_unmap_sg+0x90/0xa4 sdhci_post_req+0x5c/0x78 mmc_test_start_areq+0x10c/0x120 [mmc_test] mmc_test_area_io_seq+0x150/0x264 [mmc_test] mmc_test_rw_multiple+0x174/0x1c0 [mmc_test] mmc_test_rw_multiple_sg_len+0x44/0x6c [mmc_test] mmc_test_profile_sglen_wr_nonblock_perf+0x6c/0x94 [mmc_test] mtf_test_write+0x238/0x3cc [mmc_test] Signed-off-by: Veerabhadrarao Badiganti Reviewed-by: Stephen Boyd Tested-by: Sai Prakash Ranjan Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/1582714668-17247-1-git-send-email-vbadigan@codeaurora.org Signed-off-by: Ulf Hansson

mmc: core: Fix indentation

2020-03-24T13:35:42Z

sdio_single_irq_set() was indented with a mix of tabs and spaces. Signed-off-by: Jérôme Pouiller Link: https://lore.kernel.org/r/20200221163147.608677-1-Jerome.Pouiller@silabs.com Signed-off-by: Ulf Hansson