linux-stable.git/drivers/mmc, branch linux-2.6.33.y

mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish

2011-05-09T23:04:43+00:00

commit 0c9c99a765321104cc5f9c97f949382a9ba4927e upstream.

It seems that under certain circumstances the sdhci_tasklet_finish()
call can be entered with mrq set to NULL, causing the system to crash
with a NULL pointer de-reference.

Seen on S3C6410 system.  Based on a patch by Dimitris Papastamos.

Reported-by: Dimitris Papastamos 
Signed-off-by: Chris Ball 
Signed-off-by: Greg Kroah-Hartman

mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish

2011-05-09T23:04:43+00:00

commit b7b4d3426d2b5ecab21578eb20d8e456a1aace8f upstream.

It seems that under certain circumstances that the sdhci_tasklet_finish()
call can be entered with mrq->cmd set to NULL, causing the system to crash
with a NULL pointer de-reference.

Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at sdhci_tasklet_finish+0x34/0xe8
LR is at sdhci_tasklet_finish+0x24/0xe8

Seen on S3C6410 system.

Signed-off-by: Ben Dooks 
Signed-off-by: Mark Brown 
Signed-off-by: Chris Ball 
Signed-off-by: Greg Kroah-Hartman

mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()

2011-05-09T23:04:43+00:00

commit 9fdcdbb0d84922e7ccda2f717a04ea62629f7e18 upstream.

If pci_ioremap_bar() fails during probe, we "goto release;" and free the
host, but then we return 0 -- which tells sdhci_pci_probe() that the probe
succeeded.  Since we think the probe succeeded, when we unload sdhci we'll
go to sdhci_pci_remove_slot() and it will try to dereference slot->host,
which is now NULL because we freed it in the error path earlier.

The patch simply sets ret appropriately, so that sdhci_pci_probe() will
detect the failure immediately and bail out.

Signed-off-by: Chris Ball 
Signed-off-by: Greg Kroah-Hartman

mmc: sdio: remember new card RCA when redetecting card

2011-03-28T14:31:18+00:00

commit 0aab3995485b8a994bf29a995a008c9ea4a28054 upstream.

During redetection of a SDIO card, a request for a new card RCA
was submitted to the card, but was then overwritten by the old RCA.
This caused the card to be deselected instead of selected when using
the incorrect RCA.  This bug's been present since the "oldcard"
handling was introduced in 2.6.32.

Signed-off-by: Stefan Nilsson XK 
Reviewed-by: Ulf Hansson 
Reviewed-by: Pawel Wieczorkiewicz 
Signed-off-by: Linus Walleij 
Signed-off-by: Chris Ball 
Signed-off-by: Greg Kroah-Hartman

mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove

2011-03-21T19:43:12+00:00

commit 9320f7cbbdd5febf013b0e91db29189724057738 upstream.

If not all clocks have been defined in platform data, the driver will
cause a null pointer dereference when it is removed. This patch fixes
this issue.

Signed-off-by: Marek Szyprowski 
Signed-off-by: Kyungmin Park 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Ball 
Signed-off-by: Greg Kroah-Hartman

sdhci-s3c: add missing remove function

2010-08-02T17:26:39+00:00

commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 upstream.

System will crash sooner or later once the memory with the code of the
s3c-sdhci.ko module is reused for something else. I really have no idea
how the lack of remove function went unnoticed into the mainline code.

Signed-off-by: Marek Szyprowski 
Signed-off-by: Kyungmin Park 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

mmc: atmel-mci: remove data error interrupt after xfer

2010-05-26T21:32:05+00:00

commit abc2c9fdf636c4335a8d72ac3c5ae152bca44b68 upstream.

Disable data error interrupts while we are actually recording that there
is not such errors.  This will prevent, in some cases, the warning message
printed at new request queuing (in atmci_start_request()).

Signed-off-by: Nicolas Ferre 
Cc: Haavard Skinnemoen 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

mmc: atmel-mci: prevent kernel oops while removing card

2010-05-26T21:32:05+00:00

commit 009a891b22395fc86e5f34057d79fffee4509ab5 upstream.

The removing of an SD card in certain circumstances can lead to a kernel
oops if we do not make sure that the "data" field of the host structure is
valid.  This patch adds a test in atmci_dma_cleanup() function and also
calls atmci_stop_dma() before throwing away the reference to data.

Signed-off-by: Nicolas Ferre 
Cc: Haavard Skinnemoen 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

mmc: atmel-mci: fix two parameters swapped

2010-05-26T21:32:05+00:00

commit ebb1fea9b3adf25d7e2f643c614163af4f93a17f upstream.

Two parameters were swapped in the calls to atmci_init_slot().

Signed-off-by: Nicolas Ferre 
Reported-by: Anders Grahn 
Cc: Haavard Skinnemoen 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

s3cmci: initialize default platform data no_wprotect and no_detect with 1

2010-03-15T16:07:04+00:00

commit c212808a1ba6bfba489006399b8152a047305acf upstream.

If no platform_data was givin to the device it's going to use it's default
platform data struct which has all fields initialized to zero.  As a
result the driver is going to try to request gpio0 both as write protect
and card detect pin.  Which of course will fail and makes the driver
unusable

Previously to the introduction of no_wprotect and no_detect the behavior
was to assume that if no platform data was given there is no write protect
or card detect pin.  This patch restores that behavior.

Signed-off-by: Lars-Peter Clausen 
Cc: Ben Dooks 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman