linux-stable.git/drivers/memstick, branch v3.16.78

memstick: Fix error cleanup path of memstick_init

2019-10-31T22:14:53+00:00

commit 65f1a0d39c289bb6fc85635528cd36c4b07f560e upstream.

If bus_register fails. On its error handling path, it has cleaned up
what it has done. There is no need to call bus_unregister again.
Otherwise, if bus_unregister is called, issues such as null-ptr-deref
will arise.

Syzkaller report this:

kobject_add_internal failed for memstick (error: -12 parent: bus)
BUG: KASAN: null-ptr-deref in sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
Read of size 8 at addr 0000000000000078 by task syz-executor.0/4460

Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa9/0x10e lib/dump_stack.c:113
 __kasan_report+0x171/0x18d mm/kasan/report.c:321
 kasan_report+0xe/0x20 mm/kasan/common.c:614
 sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
 sysfs_remove_file include/linux/sysfs.h:519 [inline]
 bus_remove_file+0x6c/0x90 drivers/base/bus.c:145
 remove_probe_files drivers/base/bus.c:599 [inline]
 bus_unregister+0x6e/0x100 drivers/base/bus.c:916 ? 0xffffffffc1590000
 memstick_init+0x7a/0x1000 [memstick]
 do_one_initcall+0xb9/0x3b5 init/main.c:914
 do_init_module+0xe0/0x330 kernel/module.c:3468
 load_module+0x38eb/0x4270 kernel/module.c:3819
 __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
 do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fixes: baf8532a147d ("memstick: initial commit for Sony MemoryStick support")
Reported-by: Hulk Robot 
Signed-off-by: Wang Hai 
Signed-off-by: Ulf Hansson 
Signed-off-by: Ben Hutchings

memstick: rtsx_usb_ms: Manage runtime PM when accessing the device

2017-02-23T03:54:16+00:00

commit 9158cb29e7c2f10dd325eb1589f0fe745a271257 upstream.

Accesses to the rtsx usb device, which is the parent of the rtsx memstick
device, must not be done unless it's runtime resumed. This is currently not
the case and it could trigger various errors.

Fix this by properly deal with runtime PM in this regards. This means
making sure the device is runtime resumed, when serving requests via the
->request() callback or changing settings via the ->set_param() callbacks.

Cc: Ritesh Raj Sarraf 
Cc: Alan Stern 
Signed-off-by: Ulf Hansson 
Signed-off-by: Ben Hutchings

memstick: rtsx_usb_ms: Runtime resume the device when polling for cards

2017-02-23T03:54:16+00:00

commit 796aa46adf1d90eab36ae06a42e6d3f10b28a75c upstream.

Accesses to the rtsx usb device, which is the parent of the rtsx memstick
device, must not be done unless it's runtime resumed.

Therefore when the rtsx_usb_ms driver polls for inserted memstick cards,
let's add pm_runtime_get|put*() to make sure accesses is done when the
rtsx usb device is runtime resumed.

Reported-by: Ritesh Raj Sarraf 
Tested-by: Ritesh Raj Sarraf 
Signed-off-by: Alan Stern 
Signed-off-by: Ulf Hansson 
Signed-off-by: Ben Hutchings

memstick: mspro_block: add missing curly braces

2015-05-06T10:33:10+00:00

commit 13f6b191aaa11c7fd718d35a0c565f3c16bc1d99 upstream.

Using the indenting we can see the curly braces were obviously intended.
This is a static checker fix, but my guess is that we don't read enough
bytes, because we don't calculate "t_len" correctly.

Fixes: f1d82698029b ('memstick: use fully asynchronous request processing')
Signed-off-by: Dan Carpenter 
Cc: Alex Dubov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Luis Henriques

drivers/memstick/host/rtsx_pci_ms.c: add cancel_work when remove driver

2014-06-23T23:47:44+00:00

Add cancel_work_sync() in rtsx_pci_ms_drv_remove() to cancel pending
request work when removing the driver.

Signed-off-by: Micky Ching 
Cc: Samuel Ortiz  says:
Cc: Maxim Levitsky 
Cc: Greg Kroah-Hartman 
Cc: Alex Dubov 
Cc: Roger Tseng 
Cc: Wei WANG 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

memstick: Add realtek USB memstick host driver

2014-04-28T10:02:46+00:00

Realtek USB memstick host driver provides memstick host support based on the
Realtek USB card reader MFD driver.

Signed-off-by: Roger Tseng 
Signed-off-by: Lee Jones

drivers/memstick/host/rtsx_pci_ms.c: fix ms card data transfer bug

2014-01-24T00:37:04+00:00

This patch is used to add support for ms card. The main difference
between ms card and mspro card is long data transfer mode. mspro card
can use auto mode DMA for long data transfer, but ms can not use this
mode, it should use normal mode DMA.

The memstick core added support for ms card, but the original driver will
make ms card fail at initialization, because it uses auto mode DMA.  This
patch makes the ms card work properly.

Signed-off-by: Micky Ching 
Cc: Maxim Levitsky 
Cc: Samuel Ortiz 
Cc: Alex Dubov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

tree-wide: use reinit_completion instead of INIT_COMPLETION

2013-11-15T00:32:21+00:00

Use this new function to make code more comprehensible, since we are
reinitialzing the completion, not initializing.

[akpm@linux-foundation.org: linux-next resyncs]
Signed-off-by: Wolfram Sang 
Acked-by: Linus Walleij  (personally at LCE13)
Cc: Ingo Molnar 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

drivers/memstick/core/ms_block.c: fix spelling of MSB_RP_RECIVE_STATUS_REG

2013-11-15T00:32:13+00:00

Cc: Maxim Levitsky 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

drivers/memstick/core/ms_block.c: fix unreachable state in h_msb_read_page()

2013-11-13T03:09:35+00:00

In h_msb_read_page() in ms_block.c, flow never reaches case
MSB_RP_RECIVE_STATUS_REG.  This causes error when MEMSTICK_INT_ERR is
encountered and status error bits are going to be examined, but the status
will never be copied back.

Fix it by transitioning to MSB_RP_RECIVE_STATUS_REG right after
MSB_RP_SEND_READ_STATUS_REG.

Signed-off-by: Roger Tseng 
Acked-by: Maxim Levitsky 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds