summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatt Fleming <matt@console-pimps.org>2009-12-17 15:27:18 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2009-12-17 15:45:31 -0800
commite8812793637b4f23f01eb46db86b5dad1fc97f2a (patch)
tree917fbb17c767f17c486990737d7938c756bdec49
parent3d10a1ba0d37c8f5fd5afcdda00613fbb8a90bf5 (diff)
downloadlinux-sh-e8812793637b4f23f01eb46db86b5dad1fc97f2a.tar.gz
sdio: initialise SDIO functions and update card->sdio_funcs in lockstep
Daniel Drake noticed a crash in the error path of mmc_attach_sdio(). This bug is discussed at http://dev.laptop.org/ticket/9707. BUG: unable to handle kernel paging request at 6b6b6c57 IP: [<b066d6e2>] sdio_remove_func+0x9/0x27 Call Trace: [<b066cfb4>] ? mmc_sdio_remove+0x34/0x65 [<b066d1fc>] ? mmc_attach_sdio+0x217/0x240 [<b066a22f>] ? mmc_rescan+0x1a2/0x20f [<b042e9a0>] ? worker_thread+0x156/0x1e We need to accurately track how many SDIO functions have been initialised (and keep card->sdio_funcs in sync) so that we don't try to remove more functions than we initialised if we hit the error path in mmc_attach_sdio(). Without this patch if we hit the error path in mmc_attach_sdio() we run the risk of deferencing invalid memory in sdio_remove_func(), leading to a crash. Signed-off-by: Matt Fleming <matt@console-pimps.org> Cc: Daniel Drake <dsd@laptop.org> Cc: <linux-mmc@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/mmc/core/sdio.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index cdb845b68ab5..06b64085a355 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -516,7 +516,8 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
* The number of functions on the card is encoded inside
* the ocr.
*/
- card->sdio_funcs = funcs = (ocr & 0x70000000) >> 28;
+ funcs = (ocr & 0x70000000) >> 28;
+ card->sdio_funcs = 0;
/*
* If needed, disconnect card detection pull-up resistor.
@@ -528,7 +529,7 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
/*
* Initialize (but don't add) all present functions.
*/
- for (i = 0;i < funcs;i++) {
+ for (i = 0; i < funcs; i++, card->sdio_funcs++) {
err = sdio_init_func(host->card, i + 1);
if (err)
goto remove;