MMC core:

- Fix eMMC packed command header endianness
  - Fix free of uninitialized buffer for mmc ioctl
 
 MMC host:
  - pxamci: Fix potential oops in ->probe()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJXjy83AAoJEP4mhCVzWIwpWlcP/0rpRHM0u1wR4kBAsLxLp+7/
 4DM62lTZMwXm48urG05ATSJWhlHg0YVna2PcTwmsS5+sBg2GIHW2mMsdIly59/Fi
 f/XAXe4RK4qFpcZPgurG/LXWlNq4KyB3CPVMc/9TgongBhuuCGhdp0lwrAWzZjSo
 UmUUr9aTlaArzZc1g5pr74OYcAj4NDtAs8YeVoUKlBw0RrF9sYwKJDoTwmIckSjk
 End6bLmSXXhRauS619D+bCYr14DvQ2F/wTFCJMNzymdnm4Y1wDS2R0MNuYwTzdAj
 3w/SmT4qH1UA/Rt2j9A7E3dY6mx5KwasqRvNmX2LU5MipFeSog3OSWRnZihPxjZF
 aV+CPch3q6GpxilGFs2Hfn088KhDlcm/b5zA8u+YhnTEyTm+shoLI47fDclDZ10x
 SsoE7/dnAa9D8Hb75oYx0ATe5o1wRkM3BD5JkPHv4NwWOputFvnFkxiQhKc1AL56
 j5DIDqJkXnbyFelN1OfowmuCEvMAfaVkMBGm/RZI+EHqe4zAFMXDBSTyOsY6Zsoh
 71eek2UiN2rVBa79ny2wpCfOW9s8x8FaWDs9n/YwoyvEvuAL1PEquVSBxcFcCLjK
 ULMwK38ROnLOsZooVG8LOYc07xkyBZ+EBJY5fzhgAX/a2dMb252UnX++6Q6JBA2r
 1K1SR+etP5mHR+QztIWm
 =jUCo
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v4.7-rc7' of git://git.linaro.org/people/ulf.hansson/mmc

Pull MMC fixes from Ulf Hansson:
 "Here are a few late mmc fixes intended for v4.7 final.

  MMC core:
   - Fix eMMC packed command header endianness
   - Fix free of uninitialized buffer for mmc ioctl

  MMC host:
   - pxamci: Fix potential oops in ->probe()"

* tag 'mmc-v4.7-rc7' of git://git.linaro.org/people/ulf.hansson/mmc:
  mmc: pxamci: fix potential oops
  mmc: block: fix packed command header endianness
  mmc: block: fix free of uninitialized 'idata->buf'
This commit is contained in:
Linus Torvalds 2016-07-23 11:43:17 +09:00
commit ea4b3cfa6a
2 changed files with 18 additions and 14 deletions

View File

@ -355,8 +355,10 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
goto idata_err;
}
if (!idata->buf_bytes)
if (!idata->buf_bytes) {
idata->buf = NULL;
return idata;
}
idata->buf = kmalloc(idata->buf_bytes, GFP_KERNEL);
if (!idata->buf) {
@ -1786,8 +1788,8 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
packed_cmd_hdr = packed->cmd_hdr;
memset(packed_cmd_hdr, 0, sizeof(packed->cmd_hdr));
packed_cmd_hdr[0] = (packed->nr_entries << 16) |
(PACKED_CMD_WR << 8) | PACKED_CMD_VER;
packed_cmd_hdr[0] = cpu_to_le32((packed->nr_entries << 16) |
(PACKED_CMD_WR << 8) | PACKED_CMD_VER);
hdr_blocks = mmc_large_sector(card) ? 8 : 1;
/*
@ -1801,14 +1803,14 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
((brq->data.blocks * brq->data.blksz) >=
card->ext_csd.data_tag_unit_size);
/* Argument of CMD23 */
packed_cmd_hdr[(i * 2)] =
packed_cmd_hdr[(i * 2)] = cpu_to_le32(
(do_rel_wr ? MMC_CMD23_ARG_REL_WR : 0) |
(do_data_tag ? MMC_CMD23_ARG_TAG_REQ : 0) |
blk_rq_sectors(prq);
blk_rq_sectors(prq));
/* Argument of CMD18 or CMD25 */
packed_cmd_hdr[((i * 2)) + 1] =
packed_cmd_hdr[((i * 2)) + 1] = cpu_to_le32(
mmc_card_blockaddr(card) ?
blk_rq_pos(prq) : blk_rq_pos(prq) << 9;
blk_rq_pos(prq) : blk_rq_pos(prq) << 9);
packed->blocks += blk_rq_sectors(prq);
i++;
}

View File

@ -789,15 +789,17 @@ static int pxamci_probe(struct platform_device *pdev)
gpio_direction_output(gpio_power,
host->pdata->gpio_power_invert);
}
if (gpio_is_valid(gpio_ro))
if (gpio_is_valid(gpio_ro)) {
ret = mmc_gpio_request_ro(mmc, gpio_ro);
if (ret) {
dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n",
gpio_ro);
goto out;
} else {
mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
0 : MMC_CAP2_RO_ACTIVE_HIGH;
}
}
if (gpio_is_valid(gpio_cd))
ret = mmc_gpio_request_cd(mmc, gpio_cd, 0);