kernel/linux.git/drivers/memstick/core, branch v6.1.168

memstick: Add timeout to prevent indefinite waiting

2025-12-06T21:12:15+00:00

[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ] Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures. Signed-off-by: Jiayi Li Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin

memstick: Fix deadlock by moving removing flag earlier

2025-08-28T14:26:13+00:00

commit 99d7ab8db9d8230b243f5ed20ba0229e54cc0dfa upstream. The existing memstick core patch: commit 62c59a8786e6 ("memstick: Skip allocating card when removing host") sets host->removing in memstick_remove_host(),but still exists a critical time window where memstick_check can run after host->eject is set but before removing is set. In the rtsx_usb_ms driver, the problematic sequence is: rtsx_usb_ms_drv_remove: memstick_check: host->eject = true cancel_work_sync(handle_req) if(!host->removing) ... memstick_alloc_card() memstick_set_rw_addr() memstick_new_req() rtsx_usb_ms_request() if(!host->eject) skip schedule_work wait_for_completion() memstick_remove_host: [blocks indefinitely] host->removing = true flush_workqueue() [block] 1. rtsx_usb_ms_drv_remove sets host->eject = true 2. cancel_work_sync(&host->handle_req) runs 3. memstick_check work may be executed here <-- danger window 4. memstick_remove_host sets removing = 1 During this window (step 3), memstick_check calls memstick_alloc_card, which may indefinitely waiting for mrq_complete completion that will never occur because rtsx_usb_ms_request sees eject=true and skips scheduling work, memstick_set_rw_addr waits forever for completion. This causes a deadlock when memstick_remove_host tries to flush_workqueue, waiting for memstick_check to complete, while memstick_check is blocked waiting for mrq_complete completion. Fix this by setting removing=true at the start of rtsx_usb_ms_drv_remove, before any work cancellation. This ensures memstick_check will see the removing flag immediately and exit early, avoiding the deadlock. Fixes: 62c59a8786e6 ("memstick: Skip allocating card when removing host") Signed-off-by: Jiayi Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250804013604.1311218-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman

memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()

2025-07-24T06:51:49+00:00

commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream. A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer: drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, | ^~~~~~ Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'. Cc: stable@vger.kernel.org Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman

memstick: fix memory leak if card device is never registered

2023-04-26T12:28:39+00:00

commit 4b6d621c9d859ff89e68cebf6178652592676013 upstream. When calling dev_set_name() memory is allocated for the name for the struct device. Once that structure device is registered, or attempted to be registerd, with the driver core, the driver core will handle cleaning up that memory when the device is removed from the system. Unfortunatly for the memstick code, there is an error path that causes the struct device to never be registered, and so the memory allocated in dev_set_name will be leaked. Fix that leak by manually freeing it right before the memory for the device is freed. Cc: Maxim Levitsky Cc: Alex Dubov Cc: Ulf Hansson Cc: "Rafael J. Wysocki" Cc: Hans de Goede Cc: Kay Sievers Cc: linux-mmc@vger.kernel.org Fixes: 0252c3b4f018 ("memstick: struct device - replace bus_id with dev_name(), dev_set_name()") Cc: stable Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Co-developed-by: Mirsad Goran Todorovac Signed-off-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/20230401200327.16800-1-gregkh@linuxfoundation.org Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman

memstick/ms_block: Add check for alloc_ordered_workqueue

2022-12-31T12:32:25+00:00

[ Upstream commit 4f431a047a5c8698ed4b67e2760cfbeb5fffb69d ] As the alloc_ordered_workqueue may return NULL pointer, it should be better to add check for the return value. Moreover, the msb->io_queue should be freed if error occurs later. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20221126012558.34374-1-jiasheng@iscas.ac.cn Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin

Merge tag 'mmc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

2022-08-05T02:41:09+00:00

Pull MMC updates from Ulf Hansson: "MMC core: - Add support for the asynchronous SDIO wakeup interrupts - Skip redundant evaluation of eMMC HS400 caps when no-MMC-cap - Add support to store error stats from host drivers - Extend debugfs to show error stats from host drivers - Add single I/O read support in the recovery path for 4k sector cards MMC host: - dw_mmc-exynos: Convert corresponding DT bindings to the dtschema - dw_mmc-rockchip: Add support for the Rockchip RV1126 variant - mmc_spi: Convert corresponding DT bindings to the dtschema - mtk-sd: Extend support for interrupts/pinctrls for SDIO low-power mode - mtk-sd: Add support for SDIO wake irqs - mtk-sd: Add support for the Mediatek MT8188 variant - renesas_sdhi: Drop redundant manual tap correction for newer SoCs - renesas_sdhi: Add support for the R-Car S4-8 and generic Gen4 variants - sdhci/cqhci: Add support to capture stats from host errors - sdhci-brcmstb: Add ability to increase max clock rate for SDIO on 72116b0 - sdhci-msm: Add support for the MSM8998 and SM8450 variant - sdhci-of-at91: Fixup UHS-I mode by rewriting of MC1R - sdhci-of-dwcmshc: Add support for the Rockchip rk3588 variant - sdhci-of-dwcmshc: Enable reset support for the Rockchip variants - sdhci-pci-gli: Improve I/O read/write performance for GL9763E - sdhci-s3c: Convert corresponding DT bindings to the dtschema - tmio: Avoid glitches when resetting MEMSTICK core: - A couple of minor fixes and cleanups" * tag 'mmc-v5.20' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (61 commits) mmc: mediatek: add support for SDIO eint wakup IRQ mmc: core: Add support for SDIO wakeup interrupt dt-bindings: mmc: mtk-sd: extend interrupts and pinctrls properties dt-bindings: mmc: rockchip-dw-mshc: Document Rockchip RV1126 mmc: renesas_sdhi: newer SoCs don't need manual tap correction mmc: cavium-thunderx: Add of_node_put() when breaking out of loop mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: core: quirks: Add of_node_put() when breaking out of loop mmc: sdhci-brcmstb: use clk_get_rate(base_clk) in PM resume dt-bindings: mmc: sdhci-msm: Document the SM8450 compatible mmc: sdhci-msm: drop redundant of_device_id entries dt-bindings: mmc: sdhci-msm: add MSM8998 mmc: block: Add single read for 4k sector cards mmc: mxcmmc: Use mmc_card_sdio macro mmc: core: Use mmc_card_* macro and add a new for the sd_combo type dt-bindings: mmc: sdhci-msm: constrain reg-names per variants dt-bindings: mmc: sdhci-msm: fix reg-names entries dt-bindings: mmc: Add compatible for MediaTek MT8188 dt-bindings: mmc: sdhci-msm: document resets mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R ...

memstick/ms_block: Use the bitmap API when applicable

2022-07-12T10:29:36+00:00

Use bitmap_equal() instead of hand writing it. It improves semantic and avoids some explicit computation to convert a number of bits to a number of bytes. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/b216df8798f765ab14bce65739c220643320f376.1656155715.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson

memstick/ms_block: Fix a memory leak

2022-07-12T10:29:36+00:00

'erased_blocks_bitmap' is never freed. As it is allocated at the same time as 'used_blocks_bitmap', it is likely that it should be freed also at the same time. Add the corresponding bitmap_free() in msb_data_clear(). Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/b3b78926569445962ea5c3b6e9102418a9effb88.1656155715.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson

memstick/ms_block: Fix some incorrect memory allocation

2022-07-12T10:29:36+00:00

Some functions of the bitmap API take advantage of the fact that a bitmap is an array of long. So, to make sure this assertion is correct, allocate bitmaps with bitmap_zalloc() instead of kzalloc()+hand-computed number of bytes. While at it, also use bitmap_free() instead of kfree() to keep the semantic. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/dbf633c48c24ae6d95f852557e8d8b3bbdef65fe.1656155715.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson

block: remove blk_cleanup_disk

2022-06-28T12:33:15+00:00

blk_cleanup_disk is nothing but a trivial wrapper for put_disk now, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20220619060552.1850436-7-hch@lst.de Signed-off-by: Jens Axboe