From e8812793637b4f23f01eb46db86b5dad1fc97f2a Mon Sep 17 00:00:00 2001 From: Matt Fleming Date: Thu, 17 Dec 2009 15:27:18 -0800 Subject: sdio: initialise SDIO functions and update card->sdio_funcs in lockstep Daniel Drake noticed a crash in the error path of mmc_attach_sdio(). This bug is discussed at http://dev.laptop.org/ticket/9707. BUG: unable to handle kernel paging request at 6b6b6c57 IP: [] sdio_remove_func+0x9/0x27 Call Trace: [] ? mmc_sdio_remove+0x34/0x65 [] ? mmc_attach_sdio+0x217/0x240 [] ? mmc_rescan+0x1a2/0x20f [] ? worker_thread+0x156/0x1e We need to accurately track how many SDIO functions have been initialised (and keep card->sdio_funcs in sync) so that we don't try to remove more functions than we initialised if we hit the error path in mmc_attach_sdio(). Without this patch if we hit the error path in mmc_attach_sdio() we run the risk of deferencing invalid memory in sdio_remove_func(), leading to a crash. Signed-off-by: Matt Fleming Cc: Daniel Drake Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/mmc/core/sdio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers/mmc/core') diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c index cdb845b68ab5..06b64085a355 100644 --- a/drivers/mmc/core/sdio.c +++ b/drivers/mmc/core/sdio.c @@ -516,7 +516,8 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr) * The number of functions on the card is encoded inside * the ocr. */ - card->sdio_funcs = funcs = (ocr & 0x70000000) >> 28; + funcs = (ocr & 0x70000000) >> 28; + card->sdio_funcs = 0; /* * If needed, disconnect card detection pull-up resistor. @@ -528,7 +529,7 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr) /* * Initialize (but don't add) all present functions. */ - for (i = 0;i < funcs;i++) { + for (i = 0; i < funcs; i++, card->sdio_funcs++) { err = sdio_init_func(host->card, i + 1); if (err) goto remove; -- cgit v1.2.3-59-g8ed1b