Patch "mmc: sdhci: further fix for DMA unmapping in sdhci_post_req()" has been added to the 4.5-stable tree

This is a note to let you know that I've just added the patch titled

mmc: sdhci: further fix for DMA unmapping in sdhci_post_req()

to the 4.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mmc-sdhci-further-fix-for-dma-unmapping-in-sdhci_post_req.patch
and it can be found in the queue-4.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Russell King <[email protected]>
Date: Tue, 26 Jan 2016 13:40:53 +0000
Subject: mmc: sdhci: further fix for DMA unmapping in sdhci_post_req()

From: Russell King <[email protected]>

commit 771a3dc225815b7cc691c1ce703a3af8488e48df upstream.

sdhci_post_req() exists to unmap a previously mapped but already finished request, while the next request is in progress. However, the state of the SDHCI_REQ_USE_DMA flag depends on the last submitted request.

This means we can end up clearing the flag due to a quirk, which then means that sdhci_post_req() fails to unmap the DMA buffer, potentially leading to data corruption.

We can safely ignore the SDHCI_REQ_USE_DMA here, as testing data->host_cookie is entirely sufficient.

---
 drivers/mmc/host/sdhci.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

@@ -2115,14 +2115,13 @@ static void sdhci_post_req(struct mmc_ho
 	struct sdhci_host *host = mmc_priv(mmc);
 	struct mmc_data *data = mrq->data;
 
-	if (host->flags & SDHCI_REQ_USE_DMA) {
-		if (data->host_cookie == COOKIE_GIVEN ||
-				data->host_cookie == COOKIE_MAPPED)
-			dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
-					 data->flags & MMC_DATA_WRITE ?
-					 DMA_TO_DEVICE : DMA_FROM_DEVICE);
-		data->host_cookie = COOKIE_UNMAPPED;
-	}
+	if (data->host_cookie == COOKIE_GIVEN ||
+	    data->host_cookie == COOKIE_MAPPED)
+		dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+			     data->flags & MMC_DATA_WRITE ?
+			       DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+	data->host_cookie = COOKIE_UNMAPPED;
 }
 
 static int sdhci_pre_dma_transfer(struct sdhci_host *host,

Patches currently in stable-queue which might be from [email protected] are

queue-4.5/mmc-sdhci-fix-command-response-crc-error-handling.patch queue-4.5/mmc-sdhci-avoid-unnecessary-mapping-unmapping-of-align-buffer.patch queue-4.5/mmc-sdhci-move-initialisation-of-command-error-member.patch queue-4.5/mmc-sdhci-fix-data-timeout-part-2.patch queue-4.5/mmc-sdhci-clean-up-command-error-handling.patch queue-4.5/mmc-sdhci-further-fix-for-dma-unmapping-in-sdhci_post_req.patch queue-4.5/mmc-sdhci-pxav3-fix-higher-speed-mode-capabilities.patch queue-4.5/mmc-sdhci-fix-data-timeout-part-1.patch queue-4.5/mmc-sdhci-plug-dma-mapping-leak-on-error.patch