From 63c211803a272d59dcb11af82ad0364b3d1d2a2e Mon Sep 17 00:00:00 2001 From: Chuansheng Liu Date: Tue, 5 Nov 2013 14:52:45 +0800 Subject: mmc: sdhci: Setting the host->mrq to NULL before executing tuning In function sdhci_request(), it is possible to do the tuning execution like below: sdhci_request() { spin_lock_irqsave(&host->lock, flags); host->mrq = mrq; ... spin_unlock_irqrestore(&host->lock, flags); <=== Here it is possible one pending finish_tasklet get running and it will operate the original mrq, and notified the mrq is done, and causes memory corruption. sdhci_execute_tuning(mmc, tuning_opcode); spin_lock_irqsave(&host->lock, flags); host->mrq = mrq; ... } In the above race place, the original mrq should not be finished wrongly, so here before unlock the spinlock, we need to set the host->mrq to NULL to avoid this case. Signed-off-by: Liu, Chuansheng Signed-off-by: Chris Ball --- drivers/mmc/host/sdhci.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'drivers/mmc/host') diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c index 6840322c12a0..cc00bed3e200 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c @@ -1396,6 +1396,13 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq) mmc->card->type == MMC_TYPE_MMC ? MMC_SEND_TUNING_BLOCK_HS200 : MMC_SEND_TUNING_BLOCK; + + /* Here we need to set the host->mrq to NULL, + * in case the pending finish_tasklet + * finishes it incorrectly. + */ + host->mrq = NULL; + spin_unlock_irqrestore(&host->lock, flags); sdhci_execute_tuning(mmc, tuning_opcode); spin_lock_irqsave(&host->lock, flags); -- cgit v1.2.2