lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

misc: rtsx_usb: use separate command and response buffers

Browse Source 
commit 3776c78559853fd151be7c41e369fd076fb679d5 upstream.

rtsx_usb uses same buffer for command and response. There could
be a potential conflict using the same buffer for both especially
if retries and timeouts are involved.

Use separate command and response buffers to avoid conflicts.

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/07e3721804ff07aaab9ef5b39a5691d0718b9ade.1656642167.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Shuah Khan 2022-06-30 20:32:56 -06:00 committed by Greg Kroah-Hartman
parent 0e517d0d7f
commit 29612c43a2
2 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/misc/cardreader/rtsx_usb.c
View File

@ -631,15 +631,18 @@ static int rtsx_usb_probe(struct usb_interface *intf,
ucr->pusb_dev = usb_dev; ucr->pusb_dev = usb_dev;
ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL); ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
if (!ucr->iobuf) if (!ucr->cmd_buf)
return -ENOMEM; return -ENOMEM;
ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
if (!ucr->rsp_buf)
goto out_free_cmd_buf;
usb_set_intfdata(intf, ucr); usb_set_intfdata(intf, ucr);
ucr->vendor_id = id->idVendor; ucr->vendor_id = id->idVendor;
ucr->product_id = id->idProduct; ucr->product_id = id->idProduct;
ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf;
mutex_init(&ucr->dev_mutex); mutex_init(&ucr->dev_mutex);
@ -667,9 +670,11 @@ static int rtsx_usb_probe(struct usb_interface *intf,
out_init_fail: out_init_fail:
usb_set_intfdata(ucr->pusb_intf, NULL); usb_set_intfdata(ucr->pusb_intf, NULL);
kfree(ucr->iobuf); kfree(ucr->rsp_buf);
ucr->iobuf = NULL; ucr->rsp_buf = NULL;
ucr->cmd_buf = ucr->rsp_buf = NULL; out_free_cmd_buf:
kfree(ucr->cmd_buf);
ucr->cmd_buf = NULL;
return ret; return ret;
} }
@ -682,9 +687,12 @@ static void rtsx_usb_disconnect(struct usb_interface *intf)
mfd_remove_devices(&intf->dev); mfd_remove_devices(&intf->dev);
usb_set_intfdata(ucr->pusb_intf, NULL); usb_set_intfdata(ucr->pusb_intf, NULL);
kfree(ucr->iobuf);
ucr->iobuf = NULL; kfree(ucr->cmd_buf);
ucr->cmd_buf = ucr->rsp_buf = NULL; ucr->cmd_buf = NULL;
kfree(ucr->rsp_buf);
ucr->rsp_buf = NULL;
} }
#ifdef CONFIG_PM #ifdef CONFIG_PM

1
include/linux/rtsx_usb.h
View File

@ -54,7 +54,6 @@ struct rtsx_ucr {
struct usb_device *pusb_dev; struct usb_device *pusb_dev;
struct usb_interface *pusb_intf; struct usb_interface *pusb_intf;
struct usb_sg_request current_sg; struct usb_sg_request current_sg;
unsigned char *iobuf;
struct timer_list sg_timer; struct timer_list sg_timer;
struct mutex dev_mutex; struct mutex dev_mutex;