Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f925803 authored by Maya Erez's avatar Maya Erez Committed by Matt Wagantall
Browse files

mmc: block: Fix an invalid use of req->cmd_flag in DISCARD operation 



When handling a DISCARD operation, the MMC request data structure may be
freed in memory. Therefore, it can't be used to retrieve the cmd_flags
for checking if MMC_REQ_NOREINSERT_MASK is set:
(!(mq->mqrq_cur->req->cmd_flags & MMC_REQ_NOREINSERT_MASK)))).

To prevent the issue we should use the local variable of cmd_flags.

Change-Id: Idef53d5bd66fa6f1faaf79644c8efb5177c75e89
Signed-off-by: default avatarMaya Erez <merez@codeaurora.org>
Signed-off-by: default avatarKonstantin Dorfman <kdorfman@codeaurora.org>
[merez@codeaurora.org: fix conflicts due to removal of stop transmission]
Signed-off-by: default avatarMaya Erez <merez@codeaurora.org>
parent 3bc5f567

drivers/mmc/card/block.c

+2 −1
Original line number Diff line number Diff line
@@ -2596,7 +2596,8 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req) 
		/* complete ongoing async transfer before issuing discard */

		if (card->host->areq)

			mmc_blk_issue_rw_rq(mq, NULL);

		if (req->cmd_flags & REQ_SECURE)

		if (cmd_flags & REQ_SECURE &&

			!(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))

			ret = mmc_blk_issue_secdiscard_rq(mq, req);

		else

			ret = mmc_blk_issue_discard_rq(mq, req);