Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 710b119d authored by Maya Erez's avatar Maya Erez Committed by Konstantin Dorfman
Browse files

mmc: block: Fix an invalid use of req->cmd_flag in DISCARD operation 



When handling a DISCARD operation, the MMC request data structure may be
freed in memory. Therefore, it can't be used to retrieve the cmd_flags
for checking if MMC_REQ_NOREINSERT_MASK is set:
(!(mq->mqrq_cur->req->cmd_flags & MMC_REQ_NOREINSERT_MASK)))).

To prevent the issue we should use the local variable of cmd_flags.

Change-Id: Idef53d5bd66fa6f1faaf79644c8efb5177c75e89
Signed-off-by: default avatarMaya Erez <merez@codeaurora.org>
Signed-off-by: default avatarKonstantin Dorfman <kdorfman@codeaurora.org>
parent c30e0fc0

drivers/mmc/card/block.c

+2 −3
Original line number Diff line number Diff line
@@ -2796,7 +2796,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req) 
		/* complete ongoing async transfer before issuing discard */

		if (card->host->areq)

			mmc_blk_issue_rw_rq(mq, NULL);

		if (req->cmd_flags & REQ_SECURE &&

		if (cmd_flags & REQ_SECURE &&

			!(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))

			ret = mmc_blk_issue_secdiscard_rq(mq, req);

		else
@@ -2824,8 +2824,7 @@ out: 
	 */

	if ((!req && !(test_bit(MMC_QUEUE_NEW_REQUEST, &mq->flags))) ||

			((test_bit(MMC_QUEUE_URGENT_REQUEST, &mq->flags)) &&

			 !(mq->mqrq_cur->req->cmd_flags &

				MMC_REQ_NOREINSERT_MASK))) {

			 !(cmd_flags & MMC_REQ_NOREINSERT_MASK))) {

		if (mmc_card_need_bkops(card))

			mmc_start_bkops(card, false);

		/*