Commit ebb2c243 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'mmc-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix trivial typo in Kconfig
   - Fixup initialization of mmc block requests

  MMC host:
   - cavium: Fix use-after-free bug reported by KASAN"

* tag 'mmc-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: cavium: Fix use-after-free in of_platform_device_destroy
  mmc: host: fix typo after MMC_DEBUG move
  mmc: block: Fix incorrectly initialized requests
parents 0666f560 b917c6d1
...@@ -242,6 +242,12 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, ...@@ -242,6 +242,12 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask) if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT; limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
/*
* mmc_init_request() depends on card->bouncesz so it must be calculated
* before blk_init_allocated_queue() starts allocating requests.
*/
card->bouncesz = mmc_queue_calc_bouncesz(host);
mq->card = card; mq->card = card;
mq->queue = blk_alloc_queue(GFP_KERNEL); mq->queue = blk_alloc_queue(GFP_KERNEL);
if (!mq->queue) if (!mq->queue)
...@@ -265,7 +271,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, ...@@ -265,7 +271,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
if (mmc_can_erase(card)) if (mmc_can_erase(card))
mmc_queue_setup_discard(mq->queue, card); mmc_queue_setup_discard(mq->queue, card);
card->bouncesz = mmc_queue_calc_bouncesz(host);
if (card->bouncesz) { if (card->bouncesz) {
blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512); blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
blk_queue_max_segments(mq->queue, card->bouncesz / 512); blk_queue_max_segments(mq->queue, card->bouncesz / 512);
......
...@@ -5,7 +5,7 @@ ...@@ -5,7 +5,7 @@
comment "MMC/SD/SDIO Host Controller Drivers" comment "MMC/SD/SDIO Host Controller Drivers"
config MMC_DEBUG config MMC_DEBUG
bool "MMC host drivers debugginG" bool "MMC host drivers debugging"
depends on MMC != n depends on MMC != n
help help
This is an option for use by developers; most people should This is an option for use by developers; most people should
......
...@@ -7,6 +7,7 @@ ...@@ -7,6 +7,7 @@
* *
* Copyright (C) 2016 Cavium Inc. * Copyright (C) 2016 Cavium Inc.
*/ */
#include <linux/device.h>
#include <linux/dma-mapping.h> #include <linux/dma-mapping.h>
#include <linux/interrupt.h> #include <linux/interrupt.h>
#include <linux/mmc/mmc.h> #include <linux/mmc/mmc.h>
...@@ -149,8 +150,11 @@ static int thunder_mmc_probe(struct pci_dev *pdev, ...@@ -149,8 +150,11 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
for (i = 0; i < CAVIUM_MAX_MMC; i++) { for (i = 0; i < CAVIUM_MAX_MMC; i++) {
if (host->slot[i]) if (host->slot[i])
cvm_mmc_of_slot_remove(host->slot[i]); cvm_mmc_of_slot_remove(host->slot[i]);
if (host->slot_pdev[i]) if (host->slot_pdev[i]) {
get_device(&host->slot_pdev[i]->dev);
of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL); of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
put_device(&host->slot_pdev[i]->dev);
}
} }
clk_disable_unprepare(host->clk); clk_disable_unprepare(host->clk);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment