kernel/linux.git/drivers/memstick/core, branch v6.12.80

memstick: Add timeout to prevent indefinite waiting

2025-11-13T20:34:02+00:00

[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ] Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures. Signed-off-by: Jiayi Li Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin

memstick: Fix deadlock by moving removing flag earlier

2025-08-28T14:31:05+00:00

commit 99d7ab8db9d8230b243f5ed20ba0229e54cc0dfa upstream. The existing memstick core patch: commit 62c59a8786e6 ("memstick: Skip allocating card when removing host") sets host->removing in memstick_remove_host(),but still exists a critical time window where memstick_check can run after host->eject is set but before removing is set. In the rtsx_usb_ms driver, the problematic sequence is: rtsx_usb_ms_drv_remove: memstick_check: host->eject = true cancel_work_sync(handle_req) if(!host->removing) ... memstick_alloc_card() memstick_set_rw_addr() memstick_new_req() rtsx_usb_ms_request() if(!host->eject) skip schedule_work wait_for_completion() memstick_remove_host: [blocks indefinitely] host->removing = true flush_workqueue() [block] 1. rtsx_usb_ms_drv_remove sets host->eject = true 2. cancel_work_sync(&host->handle_req) runs 3. memstick_check work may be executed here <-- danger window 4. memstick_remove_host sets removing = 1 During this window (step 3), memstick_check calls memstick_alloc_card, which may indefinitely waiting for mrq_complete completion that will never occur because rtsx_usb_ms_request sees eject=true and skips scheduling work, memstick_set_rw_addr waits forever for completion. This causes a deadlock when memstick_remove_host tries to flush_workqueue, waiting for memstick_check to complete, while memstick_check is blocked waiting for mrq_complete completion. Fix this by setting removing=true at the start of rtsx_usb_ms_drv_remove, before any work cancellation. This ensures memstick_check will see the removing flag immediately and exit early, avoiding the deadlock. Fixes: 62c59a8786e6 ("memstick: Skip allocating card when removing host") Signed-off-by: Jiayi Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250804013604.1311218-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman

memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()

2025-07-24T06:56:26+00:00

commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream. A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer: drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, | ^~~~~~ Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'. Cc: stable@vger.kernel.org Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman

driver core: have match() callback in struct bus_type take a const *

2024-07-03T13:16:54+00:00

In the match() callback, the struct device_driver * should not be changed, so change the function callback to be a const *. This is one step of many towards making the driver core safe to have struct device_driver in read-only memory. Because the match() callback is in all busses, all busses are modified to handle this properly. This does entail switching some container_of() calls to container_of_const() to properly handle the constant *. For some busses, like PCI and USB and HV, the const * is cast away in the match callback as those busses do want to modify those structures at this point in time (they have a local lock in the driver structure.) That will have to be changed in the future if they wish to have their struct device * in read-only-memory. Cc: Rafael J. Wysocki Reviewed-by: Alex Elder Acked-by: Sumit Garg Link: https://lore.kernel.org/r/2024070136-wrongdoer-busily-01e8@gregkh Signed-off-by: Greg Kroah-Hartman

Merge tag 'mmc-v6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

2024-03-13T17:59:28+00:00

Pull MMC updates from Ulf Hansson: "MMC core: - Drop the use of BLK_BOUNCE_HIGH - Fix partition switch for GP3 - Remove usage of the deprecated ida_simple API MMC host: - cqhci: Update bouncing email-addresses in MAINTAINERS - davinci_mmc: Use sg_miter for PIO - dw_mmc-hi3798cv200: Convert the DT bindings to YAML - dw_mmc-hi3798mv200: Add driver for the new dw_mmc variant - fsl-imx-esdhc: A couple of corrections/updates to the DT bindings - meson-mx-sdhc: Drop use of the ->card_hw_reset() callback - moxart-mmc: Use sg_miter for PIO - moxart-mmc: Fix accounting for DMA transfers - mvsdio: Use sg_miter for PIO - mxcmmc: Use sg_miter for PIO - omap: Use sg_miter for PIO - renesas,sdhi: Add support for R-Car V4M variant - sdhci-esdhc-mcf: Use sg_miter for swapping - sdhci-of-dwcmshc: Add support for Sophgo CV1800B and SG2002 variants - sh_mmcif: Use sg_miter for PIO - tmio: Avoid concurrent runs of mmc_request_done()" * tag 'mmc-v6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (44 commits) mmc: core: make mmc_host_class constant mmc: core: Fix switch on gp3 partition mmc: tmio: comment the ERR_PTR usage in this driver mmc: mmc_spi: Don't mention DMA direction mmc: dw_mmc: Remove unused of_gpio.h mmc: dw_mmc: add support for hi3798mv200 dt-bindings: mmc: hisilicon,hi3798cv200-dw-mshc: add Hi3798MV200 binding dt-bindings: mmc: dw-mshc-hi3798cv200: convert to YAML mmc: dw_mmc-hi3798cv200: remove MODULE_ALIAS() mmc: core: Use a struct device* as in-param to mmc_of_parse_clk_phase() mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function mmc: tmio: avoid concurrent runs of mmc_request_done() dt-bindings: mmc: fsl-imx-mmc: Document the required clocks mmc: sh_mmcif: Advance sg_miter before reading blocks mmc: sh_mmcif: sg_miter must not be atomic mmc: sdhci-esdhc-mcf: Flag the sg_miter as atomic dt-bindings: mmc: fsl-imx-esdhc: add default and 100mhz state mmc: core: constify the struct device_type usage mmc: sdhci-of-dwcmshc: Add support for Sophgo CV1800B and SG2002 dt-bindings: mmc: sdhci-of-dwcmhsc: Add Sophgo CV1800B and SG2002 support ...

mspro_block: pass queue_limits to blk_mq_alloc_disk

2024-02-19T23:59:31+00:00

Pass the few limits mspro_block imposes directly to blk_mq_alloc_disk instead of setting them one at a time. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20240215070300.2200308-13-hch@lst.de Signed-off-by: Jens Axboe

ms_block: pass queue_limits to blk_mq_alloc_disk

2024-02-19T23:59:31+00:00

Pass the few limits ms_block imposes directly to blk_mq_alloc_disk instead of setting them one at a time. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20240215070300.2200308-12-hch@lst.de Signed-off-by: Jens Axboe

block: pass a queue_limits argument to blk_mq_alloc_disk

2024-02-13T15:56:59+00:00

Pass a queue_limits to blk_mq_alloc_disk and apply it if non-NULL. This will allow allocating queues with valid queue limits instead of setting the values one at a time later. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: John Garry Reviewed-by: Chaitanya Kulkarni Reviewed-by: Ming Lei Reviewed-by: Damien Le Moal Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20240213073425.1621680-11-hch@lst.de Signed-off-by: Jens Axboe

memstick: core: make memstick_bus_type const

2024-02-13T12:37:28+00:00

Now that the driver core can properly handle constant struct bus_type, move the memstick_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ricardo B. Marliere Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240204-bus_cleanup-memstick-v1-1-14809d4405d8@marliere.net Signed-off-by: Ulf Hansson

memstick: fix memory leak if card device is never registered

2023-04-05T09:43:51+00:00

When calling dev_set_name() memory is allocated for the name for the struct device. Once that structure device is registered, or attempted to be registerd, with the driver core, the driver core will handle cleaning up that memory when the device is removed from the system. Unfortunatly for the memstick code, there is an error path that causes the struct device to never be registered, and so the memory allocated in dev_set_name will be leaked. Fix that leak by manually freeing it right before the memory for the device is freed. Cc: Maxim Levitsky Cc: Alex Dubov Cc: Ulf Hansson Cc: "Rafael J. Wysocki" Cc: Hans de Goede Cc: Kay Sievers Cc: linux-mmc@vger.kernel.org Fixes: 0252c3b4f018 ("memstick: struct device - replace bus_id with dev_name(), dev_set_name()") Cc: stable Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Co-developed-by: Mirsad Goran Todorovac Signed-off-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/20230401200327.16800-1-gregkh@linuxfoundation.org Signed-off-by: Ulf Hansson