[PATCH 4.5 194/238] mmc: sdhci: further fix for DMA unmapping in sdhci_post_req()

From: Greg Kroah-Hartman
Date: Sun Apr 10 2016 - 14:52:27 EST


4.5-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>

commit 771a3dc225815b7cc691c1ce703a3af8488e48df upstream.

sdhci_post_req() exists to unmap a previously mapped but already
finished request, while the next request is in progress. However, the
state of the SDHCI_REQ_USE_DMA flag depends on the last submitted
request.

This means we can end up clearing the flag due to a quirk, which then
means that sdhci_post_req() fails to unmap the DMA buffer, potentially
leading to data corruption.

We can safely ignore the SDHCI_REQ_USE_DMA here, as testing
data->host_cookie is entirely sufficient.

Signed-off-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>
[ Re-based to apply as a separate fix ]
Signed-off-by: Adrian Hunter <adrian.hunter@xxxxxxxxx>
Tested-by: Gregory CLEMENT <gregory.clement@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Ulf Hansson <ulf.hansson@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
drivers/mmc/host/sdhci.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)

--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2115,14 +2115,13 @@ static void sdhci_post_req(struct mmc_ho
struct sdhci_host *host = mmc_priv(mmc);
struct mmc_data *data = mrq->data;

- if (host->flags & SDHCI_REQ_USE_DMA) {
- if (data->host_cookie == COOKIE_GIVEN ||
- data->host_cookie == COOKIE_MAPPED)
- dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
- data->flags & MMC_DATA_WRITE ?
- DMA_TO_DEVICE : DMA_FROM_DEVICE);
- data->host_cookie = COOKIE_UNMAPPED;
- }
+ if (data->host_cookie == COOKIE_GIVEN ||
+ data->host_cookie == COOKIE_MAPPED)
+ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+ data->flags & MMC_DATA_WRITE ?
+ DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+ data->host_cookie = COOKIE_UNMAPPED;
}

static int sdhci_pre_dma_transfer(struct sdhci_host *host,