mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 14:33:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Browse Source 
Pull MMC fixes from Ulf Hansson:

 - atmel-mci: Fix use-after-free in atmci_remove due to race condition

 - loongson2: Fix sg iteration in data reorder functions

 - omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit

 - sdhci:
     - Make tuning_err a signed int
     - Unmap the bounce buffer before device release

* tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: loongson2: Fix sg iteration in data reorder functions
  mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
  mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
  mmc: sdhci: unmap the bounce buffer before device release
  mmc: sdhci: make tuning_err a signed int
This commit is contained in:
Linus Torvalds
2026-08-14 14:46:42 -07:00
parent a823c9da52 00179ed9fb
commit d2ed9eaaf2
5 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/mmc/host/atmel-mci.c
View File

@@ -2610,6 +2610,8 @@ static void atmci_remove(struct platform_device *pdev)
free_irq(platform_get_irq(pdev, 0), host);
cancel_work_sync(&host->bh_work);
clk_disable_unprepare(host->mck);
pm_runtime_disable(dev);

8
drivers/mmc/host/loongson2-mmc.c
View File

@@ -641,8 +641,8 @@ static void ls2k0500_mmc_reorder_cmd_data(struct loongson2_mmc_host *host,
return;
for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
data = sg_virt(&sg[i]);
for (j = 0; j < (sg_dma_len(&sg[i]) / 4); j++)
data = sg_virt(sg);
for (j = 0; j < (sg_dma_len(sg) / 4); j++)
if (cmd->opcode == SD_SWITCH)
data[j] = bitrev8x4(data[j]);
else
@@ -758,8 +758,8 @@ static void ls2k2000_mmc_reorder_cmd_data(struct loongson2_mmc_host *host,
return;
for_each_sg(cmd->data->sg, sg, cmd->data->sg_len, i) {
data = sg_virt(&sg[i]);
for (j = 0; j < (sg_dma_len(&sg[i]) / 4); j++)
data = sg_virt(sg);
for (j = 0; j < (sg_dma_len(sg) / 4); j++)
data[j] = bitrev8x4(data[j]);
}
}

2
drivers/mmc/host/omap_hsmmc.c
View File

@@ -1357,7 +1357,7 @@ omap_hsmmc_prepare_data(struct omap_hsmmc_host *host, struct mmc_request *req)
if (req->data == NULL) {
OMAP_HSMMC_WRITE(host->base, BLK, 0);
if (req->cmd->flags & MMC_RSP_BUSY) {
timeout = req->cmd->busy_timeout * NSEC_PER_MSEC;
timeout = (u64)req->cmd->busy_timeout * NSEC_PER_MSEC;
/*
* Set an arbitrary 100ms data timeout for commands with

16
drivers/mmc/host/sdhci.c
View File

@@ -4187,6 +4187,14 @@ void __sdhci_read_caps(struct sdhci_host *host, const u16 *ver,
}
EXPORT_SYMBOL_GPL(__sdhci_read_caps);
static void sdhci_unmap_bounce_buffer(void *data)
{
struct sdhci_host *host = data;
dma_unmap_single(mmc_dev(host->mmc), host->bounce_addr,
host->bounce_buffer_size, DMA_BIDIRECTIONAL);
}
static void sdhci_allocate_bounce_buffer(struct sdhci_host *host)
{
struct mmc_host *mmc = host->mmc;
@@ -4247,6 +4255,14 @@ static void sdhci_allocate_bounce_buffer(struct sdhci_host *host)
}
host->bounce_buffer_size = bounce_size;
ret = devm_add_action_or_reset(mmc_dev(mmc),
sdhci_unmap_bounce_buffer, host);
if (ret) {
devm_kfree(mmc_dev(mmc), host->bounce_buffer);
host->bounce_buffer = NULL;
host->bounce_buffer_size = 0;
return;
}
out:
/* Lie about this since we're bouncing */

2
drivers/mmc/host/sdhci.h
View File

@@ -659,7 +659,7 @@ struct sdhci_host {
unsigned int tuning_count; /* Timer count for re-tuning */
unsigned int tuning_mode; /* Re-tuning mode supported by host */
unsigned int tuning_err; /* Error code for re-tuning */
int tuning_err; /* Error code for re-tuning */
#define SDHCI_TUNING_MODE_1 0
#define SDHCI_TUNING_MODE_2 1
#define SDHCI_TUNING_MODE_3 2