Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 670ed36a authored by Chaotian Jing's avatar Chaotian Jing Committed by Greg Kroah-Hartman
Browse files

mmc: mediatek: fix race condition between msdc_request_timeout and irq 



[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ]

when get request SW timeout, if CMD/DAT xfer done irq coming right now,
then there is race between the msdc_request_timeout work and irq handler,
and the host->cmd and host->data may set to NULL in irq handler. also,
current flow ensure that only one path can go to msdc_request_done(), so
no need check the return value of cancel_delayed_work().

Signed-off-by: default avatarChaotian Jing <chaotian.jing@mediatek.com>
Link: https://lore.kernel.org/r/20201218071611.12276-1-chaotian.jing@mediatek.com


Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 1d086905

drivers/mmc/host/mtk-sd.c

+10 −8
Original line number Diff line number Diff line
@@ -928,13 +928,13 @@ static void msdc_track_cmd_data(struct msdc_host *host, 
static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)

{

	unsigned long flags;

	bool ret;



	ret = cancel_delayed_work(&host->req_timeout);

	if (!ret) {

		/* delay work already running */

		return;

	}

	/*

	 * No need check the return value of cancel_delayed_work, as only ONE

	 * path will go here!

	 */

	cancel_delayed_work(&host->req_timeout);



	spin_lock_irqsave(&host->lock, flags);

	host->mrq = NULL;

	spin_unlock_irqrestore(&host->lock, flags);
@@ -952,7 +952,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, 
	bool done = false;

	bool sbc_error;

	unsigned long flags;

	u32 *rsp = cmd->resp;

	u32 *rsp;



	if (mrq->sbc && cmd == mrq->cmd &&

	    (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
@@ -973,6 +973,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events, 


	if (done)

		return true;

	rsp = cmd->resp;



	sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
@@ -1154,7 +1155,7 @@ static void msdc_data_xfer_next(struct msdc_host *host, 
static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,

				struct mmc_request *mrq, struct mmc_data *data)

{

	struct mmc_command *stop = data->stop;

	struct mmc_command *stop;

	unsigned long flags;

	bool done;

	unsigned int check_data = events &
@@ -1170,6 +1171,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events, 


	if (done)

		return true;

	stop = data->stop;



	if (check_data || (stop && stop->error)) {

		dev_dbg(host->dev, "DMA status: 0x%8X\n",