Re: [PATCH] mtk-sd: Prevent memory corruption from DMA map failure
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date: 2025-06-25 04:42:57
Also in:
linux-mediatek, linux-mmc, lkml
On Wed, 25 Jun 2025 13:13:18 +0900 Sergey Senozhatsky [off-list ref] wrote:
On (25/06/25 12:56), Sergey Senozhatsky wrote:quoted
On (25/06/12 20:26), Masami Hiramatsu (Google) wrote: [..]quoted
@@ -1466,8 +1471,18 @@ static void msdc_ops_request(struct mmc_host *mmc, struct mmc_request *mrq) WARN_ON(!host->hsq_en && host->mrq); host->mrq = mrq; - if (mrq->data) + if (mrq->data) { msdc_prepare_data(host, mrq->data); + if (!msdc_data_prepared(mrq->data)) { + /* + * Failed to prepare DMA area, fail fast before + * starting any commands. + */ + mrq->cmd->error = -ENOSPC; + mmc_request_done(mmc_from_priv(host), mrq);Do we end up having a stale/dangling host->mrq pointer here?Something like this maybe?
Good catch! I thought it is cleared in mmc_request_done(), but not. I agree we need to clean it up since it is set in msdc_ops_request(). Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Thanks,
quoted hunk ↗ jump to hunk
---diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c index b12cfb9a5e5f..46bb770ace41 100644 --- a/drivers/mmc/host/mtk-sd.c +++ b/drivers/mmc/host/mtk-sd.c@@ -1498,6 +1498,7 @@ static void msdc_ops_request(struct mmc_host *mmc, struct mmc_request *mrq) */ mrq->cmd->error = -ENOSPC; mmc_request_done(mmc_from_priv(host), mrq); + host->mrq = NULL; return; } }
-- Masami Hiramatsu (Google) [off-list ref]