mmc: fix mmc_app_send_scr() for dma transfer

This patch is based on the commit "af51715079e7fb6b290e1881d63d815dc4de5011":

   * Bugfix to that mmc_send_cxd_data() code:  dma-to-stack is
     unsafe/nonportable, so kmalloc a bounce buffer instead.

The driver may invalidate the mmc_card->csd when host driver uses dma.
So this subroutine also needs a kmalloc buffer.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Chris Ball <cjb@laptop.org>

1 files changed, 13 insertions, 1 deletions

diff --git a/drivers/mmc/core/sd_ops.c b/drivers/mmc/core/sd_ops.c
index 797cdb5887fd..76af349c14b4 100644
--- a/drivers/mmc/core/sd_ops.c
+++ b/drivers/mmc/core/sd_ops.c
@@ -9,6 +9,7 @@
  * your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/scatterlist.h>
 
@@ -252,6 +253,7 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
         struct mmc_command cmd;
         struct mmc_data data;
         struct scatterlist sg;
+        void *data_buf;
 
         BUG_ON(!card);
         BUG_ON(!card->host);
@@ -263,6 +265,13 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
         if (err)
                 return err;
 
+        /* dma onto stack is unsafe/nonportable, but callers to this
+         * routine normally provide temporary on-stack buffers ...
+         */
+        data_buf = kmalloc(sizeof(card->raw_scr), GFP_KERNEL);
+        if (data_buf == NULL)
+                return -ENOMEM;
+
         memset(&mrq, 0, sizeof(struct mmc_request));
         memset(&cmd, 0, sizeof(struct mmc_command));
         memset(&data, 0, sizeof(struct mmc_data));
@@ -280,12 +289,15 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
         data.sg = &sg;
         data.sg_len = 1;
 
-        sg_init_one(&sg, scr, 8);
+        sg_init_one(&sg, data_buf, 8);
 
         mmc_set_data_timeout(&data, card);
 
         mmc_wait_for_req(card->host, &mrq);
 
+        memcpy(scr, data_buf, sizeof(card->raw_scr));
+        kfree(data_buf);
+
         if (cmd.error)
                 return cmd.error;
         if (data.error)