Commit Graph

11 Commits

Author SHA1 Message Date
Lu Baolu
8dcc5ff8fc mfd: rtsx_usb: Avoid setting ucr->current_sg.status
Member "status" of struct usb_sg_request is managed by usb core. A
spin lock is used to serialize the change of it. The driver could
check the value of req->status, but should avoid changing it without
the hold of the spinlock. Otherwise, it could cause race or error
in usb core.

This patch could be backported to stable kernels with version later
than v3.14.

Cc: stable@vger.kernel.org # 3.14+
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2016-10-04 15:48:02 +01:00
Roger Tseng
3a43477fa3 mfd: rtsx_usb: Prevent DMA from stack
Functions rtsx_usb_ep0_read_register() and rtsx_usb_get_card_status()
both use arbitrary buffer addresses from arguments directly for DMA and
the buffers could be located in stack. This was caught by DMA-API debug
check.

Fixes this by using double-buffers via kzalloc in both functions to
guarantee the validity of DMA buffer.

WARNING: CPU: 1 PID: 25 at lib/dma-debug.c:1166 check_for_stack+0x96/0xe0()
ehci-pci 0000:00:1a.0: DMA-API: device driver maps memory from stack
[addr=ffff8801199e3cef]
Modules linked in: rtsx_usb_ms arc4 memstick intel_rapl iosf_mbi
rtl8192ce snd_hda_codec_hdmi snd_hda_codec_realtek
snd_hda_codec_generic snd_hda_intel rtl_pci rtl8192c_common
snd_hda_controller x86_pkg_temp_thermal snd_hda_codec rtlwifi mac80211
coretemp kvm_intel kvm iTCO_wdt snd_hwdep snd_seq snd_seq_device
crct10dif_pclmul iTCO_vendor_support sparse_keymap cfg80211
crc32_pclmul snd_pcm crc32c_intel ghash_clmulni_intel rfkill i2c_i801
snd_timer shpchp snd serio_raw mei_me lpc_ich soundcore mei tpm_tis
tpm wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc i915
rtsx_usb_sdmmc mmc_core 8021q uas garp stp i2c_algo_bit llc mrp
drm_kms_helper usb_storage drm rtsx_usb mfd_core r8169 mii video
CPU: 1 PID: 25 Comm: kworker/1:2 Not tainted 3.20.0-0.rc0.git7.3.fc22.x86_64 #1
Hardware name: WB WB-B06211/WB-B0621, BIOS EB062IWB V1.0 12/12/2013
Workqueue: events rtsx_usb_ms_handle_req [rtsx_usb_ms]
 0000000000000000 000000003d188e66 ffff8801199e3808 ffffffff8187642b
 0000000000000000 ffff8801199e3860 ffff8801199e3848 ffffffff810ab39a
 ffff8801199e3864 ffff8801199e3cef ffff880119b57098 ffff880119b37320
Call Trace:
 [<ffffffff8187642b>] dump_stack+0x4c/0x65
 [<ffffffff810ab39a>] warn_slowpath_common+0x8a/0xc0
 [<ffffffff810ab425>] warn_slowpath_fmt+0x55/0x70
 [<ffffffff8187efe6>] ? _raw_spin_unlock_irqrestore+0x36/0x70
 [<ffffffff81453156>] check_for_stack+0x96/0xe0
 [<ffffffff81453934>] debug_dma_map_page+0x104/0x150
 [<ffffffff81613b86>] usb_hcd_map_urb_for_dma+0x646/0x790
 [<ffffffff81614165>] usb_hcd_submit_urb+0x1d5/0xa90
 [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
 [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
 [<ffffffff81103a15>] ? lockdep_init_map+0x65/0x5d0
 [<ffffffff81615d7e>] usb_submit_urb+0x42e/0x5f0
 [<ffffffff81616787>] usb_start_wait_urb+0x77/0x190
 [<ffffffff8124f035>] ? __kmalloc+0x205/0x2d0
 [<ffffffff8161697c>] usb_control_msg+0xdc/0x130
 [<ffffffffa0031669>] rtsx_usb_ep0_read_register+0x59/0x70 [rtsx_usb]
 [<ffffffffa00310c1>] ? rtsx_usb_get_rsp+0x41/0x50 [rtsx_usb]
 [<ffffffffa071da4e>] rtsx_usb_ms_handle_req+0x7ce/0x9c5 [rtsx_usb_ms]

Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-03-12 09:27:41 +00:00
Roger Tseng
bb400d2120 mfd: rtsx_usb: Defer autosuspend while card exists
A card insertion happens after the lastest polling before reader is
suspended may never have a chance to be detected. Under current 1-HZ
polling interval setting in mmc_core, the worst case of such
undetectablility is about 1 second.

To further reduce the undetectability, detect card slot again in suspend
method and defer the autosuspend if the slot is loaded. The default 2
second autosuspend delay of USB subsystem should let the next polling
detects the card.

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-01-22 16:08:02 +00:00
Roger Tseng
b166010f6a mfd: rtsx_usb: Fix runtime PM deadlock
sd_set_power_mode() in derived module drivers/mmc/host/rtsx_usb_sdmmc.c
acquires dev_mutex and then calls pm_runtime_get_sync() to make sure the
device is awake while initializing a newly inserted card. Once it is
called during suspending state and explicitly before rtsx_usb_suspend()
acquires the same dev_mutex, both routine deadlock and further hang the
driver because pm_runtime_get_sync() waits the pending PM operations.

Fix this by using an empty suspend method. mmc_core always turns the
LED off after a request is done and thus it is ok to remove the only
rtsx_usb_turn_off_led() here.

Cc: <stable@vger.kernel.org> # v3.16+
Fixes: 730876be25 ("mfd: Add realtek USB card reader driver")
Signed-off-by: Roger Tseng <rogerable@realtek.com>
[Lee: Removed newly unused variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-01-20 12:52:55 +00:00
Johan Hovold
1ab589c72e mfd: Use mfd_add_hotplug_devices() helper
Use mfd_add_hotplug_devices helper to register the subdevices.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-11-25 16:18:42 +00:00
Hans Wennborg
5e9bbf17b3 mfd: rtsx_usb: Fix decimal printf format specifiers prefixed with 0x
The prefix suggests the number should be printed in hex, so use
the %x specifier to do that.

Found by using regex suggested by Joe Perches.

Signed-off-by: Hans Wennborg <hans@hanshq.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-09-26 08:15:38 +01:00
Jeff Mahoney
1813908986 drivers/mfd/rtsx_usb.c: export device table
The rtsx_usb driver contains the table for the devices it supports but
doesn't export it.  As a result, no alias is generated and it doesn't
get loaded automatically.

Via https://bugzilla.novell.com/show_bug.cgi?id=890096

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reported-by: Marcel Witte <wittemar@googlemail.com>
Cc: Roger Tseng <rogerable@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-08-14 10:56:15 -06:00
Krzysztof Kozlowski
9031a93918 mfd: rtsx_usb: Make mfd_cell array const
mfd_add_devices() expects array of struct mfd_cell to be const.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Acked-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-06-03 08:11:39 +01:00
Roger Tseng
5f03342052 mfd: rtsx_usb: Add comment in rtsx_usb_suspend
Explain why there is no need to have a symmetric LED turn-on in resume handler
while calling rtsx_usb_turn_off_led() in suspend handler.

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-04-28 11:01:18 +01:00
Roger Tseng
fea52b8910 mfd: rtsx_usb: Fix possible race condition
Fix two possible race condition generated by misuse of del_timer in
rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
in rtsx_usb_probe().

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-04-28 11:00:57 +01:00
Roger Tseng
730876be25 mfd: Add realtek USB card reader driver
Realtek USB card reader provides a channel to transfer command or data to flash
memory cards. This driver exports host instances for mmc and memstick subsystems
and handles basic works.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-03-19 08:58:18 +00:00