1. 13 Jul, 2017 1 commit
    • Grzegorz Sluja's avatar
      mmc: block: Prevent new req entering queue after its cleanup · bbdc74dc
      Grzegorz Sluja authored
      The commit 304419d8 ("mmc: core: Allocate per-request data using the
      block layer core"), refactored the mechanism of queue handling, but also
      made mmc_init_request() to be called after mmc_cleanup_queue(). This
      triggers a null pointer dereference:
      
      [  683.123791] BUG: unable to handle kernel NULL pointer dereference at (null)
      [  683.123801] IP: mmc_init_request+0x2c/0xf0 [mmc_block]
      ...
      [  683.123905] Call Trace:
      [  683.123913]  alloc_request_size+0x4f/0x70
      [  683.123919]  mempool_alloc+0x5f/0x150
      [  683.123925]  ? __enqueue_entity+0x6c/0x70
      [  683.123928]  get_request+0x3ad/0x720
      [  683.123933]  ? prepare_to_wait_event+0x110/0x110
      [  683.123937]  blk_queue_bio+0xc1/0x3a0
      [  683.123940]  generic_make_request+0xf8/0x2a0
      [  683.123942]  submit_bio+0x75/0x150
      [  683.123947]  submit_bio_wait+0x51/0x70
      [  683.123951]  blkdev_issue_flush+0x5c/0x90
      [  683.123956]  ext4_sync_fs+0x171/0x1b0
      [  683.123961]  sync_filesystem+0x73/0x90
      [  683.123965]  fsync_bdev+0x24/0x50
      [  683.123971]  invalidate_partition+0x24/0x50
      [  683.123973]  del_gendisk+0xb2/0x2a0
      [  683.123977]  mmc_blk_remove_req.part.38+0x71/0xa0 [mmc_block]
      [  683.123980]  mmc_blk_remove+0xba/0x190 [mmc_block]
      [  683.123990]  mmc_bus_remove+0x1a/0x20 [mmc_core]
      [  683.123995]  device_release_driver_internal+0x141/0x200
      [  683.123999]  device_release_driver+0x12/0x20
      [  683.124001]  bus_remove_device+0xfd/0x170
      [  683.124004]  device_del+0x1e8/0x330
      [  683.124012]  mmc_remove_card+0x60/0xc0 [mmc_core]
      [  683.124019]  mmc_remove+0x19/0x30 [mmc_core]
      [  683.124025]  mmc_stop_host+0xfb/0x1a0 [mmc_core]
      [  683.124032]  mmc_remove_host+0x1a/0x40 [mmc_core]
      [  683.124037]  sdhci_remove_host+0x2e/0x1c0 [mmc_sdhci]
      [  683.124042]  sdhci_pci_remove_slot+0x3f/0x80 [sdhci_pci]
      [  683.124045]  sdhci_pci_remove+0x39/0x70 [sdhci_pci]
      [  683.124049]  pci_device_remove+0x39/0xc0
      [  683.124052]  device_release_driver_internal+0x141/0x200
      [  683.124056]  driver_detach+0x3f/0x80
      [  683.124059]  bus_remove_driver+0x55/0xd0
      [  683.124062]  driver_unregister+0x2c/0x50
      [  683.124065]  pci_unregister_driver+0x29/0x90
      [  683.124069]  sdhci_driver_exit+0x10/0x4f3 [sdhci_pci]
      [  683.124073]  SyS_delete_module+0x171/0x250
      [  683.124078]  entry_SYSCALL_64_fastpath+0x1e/0xa9
      
      Fix this by setting the queue DYING flag before cleanup the queue, as it
      prevents new reqs from entering the queue.
      Signed-off-by: default avatarGrzegorz Sluja <grzegorzx.sluja@intel.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Fixes: 304419d8 ("mmc: core: Allocate per-request data using the...")
      [Ulf: Updated the changelog]
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      bbdc74dc
  2. 11 Jul, 2017 3 commits
    • Geert Uytterhoeven's avatar
      mmc: block: Let MMC_IOC_MULTI_CMD return zero again for zero entries · aab2ee03
      Geert Uytterhoeven authored
      With gcc 4.1.2:
      
          drivers/mmc/core/block.c: In function ‘mmc_blk_ioctl_cmd_issue’:
          drivers/mmc/core/block.c:630: warning: ‘ioc_err’ may be used uninitialized in this function
      
      Indeed, if mq_rq->ioc_count is zero, an uninitialized value will be
      stored in mq_rq->drv_op_result and passed to blk_end_request_all().
      
      Can mq_rq->ioc_count be zero?
        - mmc_blk_ioctl_cmd() sets ioc_count to 1, so this is safe,
        - mmc_blk_ioctl_multi_cmd() obtains ioc_count from user space in
          response to the MMC_IOC_MULTI_CMD ioctl, and does allow zero.
      
      To avoid returning an uninitialized value, and as it is pointless to do
      all this work when the MMC_IOC_MULTI_CMD ioctl is used with zero
      entries, check for this early in mmc_blk_ioctl_multi_cmd(), and return
      zero, like was returned before.
      
      Fixes: 3ecd8cf2 ("mmc: block: move multi-ioctl() to use block layer")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      aab2ee03
    • Geert Uytterhoeven's avatar
      mmc: block: Initialize ret in mmc_blk_issue_drv_op() for MMC_DRV_OP_IOCTL · 7432b49b
      Geert Uytterhoeven authored
      With gcc 4.1.2:
      
          drivers/mmc/core/block.c: In function ‘mmc_blk_issue_drv_op’:
          drivers/mmc/core/block.c:1178: warning: ‘ret’ may be used uninitialized in this function
      
      Indeed, for MMC_DRV_OP_IOCTL, if mq_rq->ioc_count is zero, an
      uninitialized value will be stored in mq_rq->drv_op_result and passed to
      blk_end_request_all().
      
      Can mq_rq->ioc_count be zero?
        - mmc_blk_ioctl_cmd() sets ioc_count to 1, so this is safe,
        - mmc_blk_ioctl_multi_cmd() obtains ioc_count from user space in
          response to the MMC_IOC_MULTI_CMD ioctl, and does allow zero.
      
      Initialize ret to zero to fix this for current and future callers.
      
      Fixes: 0493f6fe ("mmc: block: Move boot partition locking into a driver op")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      7432b49b
    • Adrian Hunter's avatar
      mmc: sdhci-acpi: Workaround conflict with PCI wifi on GPD Win handheld · 17753d16
      Adrian Hunter authored
      GPDwin uses PCI wifi which conflicts with SDIO's use of
      acpi_device_fix_up_power() on child device nodes. Specifically
      acpi_device_fix_up_power() causes the wifi module to get turned off.
      Identifying GPDwin is problematic, but since SDIO is only used for wifi,
      the presence of the PCI wifi card in the expected slot with an ACPI
      companion node, is used to indicate that acpi_device_fix_up_power() should
      be avoided.
      Signed-off-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
      Acked-by: default avatarHans de Goede <hdegoede@redhat.com>
      Tested-by: default avatarHans de Goede <hdegoede@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      17753d16
  3. 10 Jul, 2017 36 commits