Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 334aa263 authored by Ritesh Harjani's avatar Ritesh Harjani
Browse files

mmc: block: Fix invalid data from freed request pointer 



When we do blk_end_request, request pointer may get freed.
Therefore cache request_queue pointer and tag value at start itself
instead of dereferencing already freed request_queue pointer.

Change-Id: I35def3ef6a260ebe78e92874ac121aca529f00cf
Signed-off-by: default avatarRitesh Harjani <riteshh@codeaurora.org>
parent d70d0441

drivers/mmc/card/block.c

+5 −3
Original line number Diff line number Diff line
@@ -2980,6 +2980,8 @@ static void mmc_blk_cmdq_err(struct mmc_queue *mq) 
	struct mmc_request *mrq = host->err_mrq;

	struct mmc_card *card = mq->card;

	struct mmc_cmdq_context_info *ctx_info = &host->cmdq_ctx;

	struct request_queue *q = mrq->req->q;

	int tag = mrq->req->tag;



	pm_runtime_get_sync(&card->dev);

	mmc_host_clk_hold(host);
@@ -3020,13 +3022,13 @@ static void mmc_blk_cmdq_err(struct mmc_queue *mq) 
					 mrq->req, &gen_err, &status);

			if (err) {

				pr_err("%s: error %d sending stop (%d) command\n",

					mrq->req->rq_disk->disk_name,

					mmc_hostname(host),

					err, status);

				goto reset;

			}

		}



		if (mmc_cmdq_discard_queue(host, mrq->req->tag))

		if (mmc_cmdq_discard_queue(host, tag))

			goto reset;

		else

			goto unhalt;
@@ -3048,7 +3050,7 @@ static void mmc_blk_cmdq_err(struct mmc_queue *mq) 


reset:

	spin_lock_irq(mq->queue->queue_lock);

	blk_queue_invalidate_tags(mrq->req->q);

	blk_queue_invalidate_tags(q);

	spin_unlock_irq(mq->queue->queue_lock);

	mmc_blk_cmdq_reset(host, true);

	goto out;