Merge tag 'mmc-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix trivial typo in Kconfig
   - Fixup initialization of mmc block requests

  MMC host:
   - cavium: Fix use-after-free bug reported by KASAN"

* tag 'mmc-v4.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: cavium: Fix use-after-free in of_platform_device_destroy
  mmc: host: fix typo after MMC_DEBUG move
  mmc: block: Fix incorrectly initialized requests

3 files changed, 12 insertions, 3 deletions

diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index affa7370ba82..74c663b1c0a7 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -242,6 +242,12 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
                 limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
 
+        /*
+         * mmc_init_request() depends on card->bouncesz so it must be calculated
+         * before blk_init_allocated_queue() starts allocating requests.
+         */
+        card->bouncesz = mmc_queue_calc_bouncesz(host);
+
         mq->card = card;
         mq->queue = blk_alloc_queue(GFP_KERNEL);
         if (!mq->queue)
@@ -265,7 +271,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_can_erase(card))
                 mmc_queue_setup_discard(mq->queue, card);
 
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
         if (card->bouncesz) {
                 blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
                 blk_queue_max_segments(mq->queue, card->bouncesz / 512);
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 02179ed2a40d..8c15637178ff 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -5,7 +5,7 @@
 comment "MMC/SD/SDIO Host Controller Drivers"
 
 config MMC_DEBUG
-        bool "MMC host drivers debugginG"
+        bool "MMC host drivers debugging"
         depends on MMC != n
         help
           This is an option for use by developers; most people should
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index b9cc95998799..eee08d81b242 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -7,6 +7,7 @@
  *
  * Copyright (C) 2016 Cavium Inc.
  */
+#include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/mmc/mmc.h>
@@ -149,8 +150,11 @@ error:
         for (i = 0; i < CAVIUM_MAX_MMC; i++) {
                 if (host->slot[i])
                         cvm_mmc_of_slot_remove(host->slot[i]);
-                if (host->slot_pdev[i])
+                if (host->slot_pdev[i]) {
+                        get_device(&host->slot_pdev[i]->dev);
                         of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+                        put_device(&host->slot_pdev[i]->dev);
+                }
         }
         clk_disable_unprepare(host->clk);
         return ret;