This is a note to let you know that I've just added the patch titled
mmc: fix host release issue after discard operation
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mmc-fix-host-release-issue-after-discard-operation.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f662ae48ae67dfd42739e65750274fe8de46240a Mon Sep 17 00:00:00 2001
From: Ray Jui <rjui@xxxxxxxxxxxx>
Date: Sat, 26 Oct 2013 11:03:44 -0700
Subject: mmc: fix host release issue after discard operation
From: Ray Jui <rjui@xxxxxxxxxxxx>
commit f662ae48ae67dfd42739e65750274fe8de46240a upstream.
Under function mmc_blk_issue_rq, after an MMC discard operation,
the MMC request data structure may be freed in memory. Later in
the same function, the check of req->cmd_flags & MMC_REQ_SPECIAL_MASK
is dangerous and invalid. It causes the MMC host not to be released
when it should.
This patch fixes the issue by marking the special request down before
the discard/flush operation.
Reported by: Harold (SoonYeal) Yang <haroldsy@xxxxxxxxxxxx>
Signed-off-by: Ray Jui <rjui@xxxxxxxxxxxx>
Reviewed-by: Seungwon Jeon <tgih.jun@xxxxxxxxxxx>
Acked-by: Seungwon Jeon <tgih.jun@xxxxxxxxxxx>
Signed-off-by: Chris Ball <cjb@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/mmc/card/block.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1931,6 +1931,7 @@ static int mmc_blk_issue_rq(struct mmc_q
struct mmc_card *card = md->queue.card;
struct mmc_host *host = card->host;
unsigned long flags;
+ unsigned int cmd_flags = req ? req->cmd_flags : 0;
if (req && !mq->mqrq_prev->req)
/* claim host only for the first request */
@@ -1946,7 +1947,7 @@ static int mmc_blk_issue_rq(struct mmc_q
}
mq->flags &= ~MMC_QUEUE_NEW_REQUEST;
- if (req && req->cmd_flags & REQ_DISCARD) {
+ if (cmd_flags & REQ_DISCARD) {
/* complete ongoing async transfer before issuing discard */
if (card->host->areq)
mmc_blk_issue_rw_rq(mq, NULL);
@@ -1955,7 +1956,7 @@ static int mmc_blk_issue_rq(struct mmc_q
ret = mmc_blk_issue_secdiscard_rq(mq, req);
else
ret = mmc_blk_issue_discard_rq(mq, req);
- } else if (req && req->cmd_flags & REQ_FLUSH) {
+ } else if (cmd_flags & REQ_FLUSH) {
/* complete ongoing async transfer before issuing flush */
if (card->host->areq)
mmc_blk_issue_rw_rq(mq, NULL);
@@ -1971,7 +1972,7 @@ static int mmc_blk_issue_rq(struct mmc_q
out:
if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) ||
- (req && (req->cmd_flags & MMC_REQ_SPECIAL_MASK)))
+ (cmd_flags & MMC_REQ_SPECIAL_MASK))
/*
* Release host when there are no more requests
* and after special request(discard, flush) is done.
Patches currently in stable-queue which might be from rjui@xxxxxxxxxxxx are
queue-3.10/mmc-fix-host-release-issue-after-discard-operation.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html