Commit Graph

10 Commits

Author SHA1 Message Date
Roger Tseng
3a43477fa3 mfd: rtsx_usb: Prevent DMA from stack
Functions rtsx_usb_ep0_read_register() and rtsx_usb_get_card_status()
both use arbitrary buffer addresses from arguments directly for DMA and
the buffers could be located in stack. This was caught by DMA-API debug
check.

Fixes this by using double-buffers via kzalloc in both functions to
guarantee the validity of DMA buffer.

WARNING: CPU: 1 PID: 25 at lib/dma-debug.c:1166 check_for_stack+0x96/0xe0()
ehci-pci 0000:00:1a.0: DMA-API: device driver maps memory from stack
[addr=ffff8801199e3cef]
Modules linked in: rtsx_usb_ms arc4 memstick intel_rapl iosf_mbi
rtl8192ce snd_hda_codec_hdmi snd_hda_codec_realtek
snd_hda_codec_generic snd_hda_intel rtl_pci rtl8192c_common
snd_hda_controller x86_pkg_temp_thermal snd_hda_codec rtlwifi mac80211
coretemp kvm_intel kvm iTCO_wdt snd_hwdep snd_seq snd_seq_device
crct10dif_pclmul iTCO_vendor_support sparse_keymap cfg80211
crc32_pclmul snd_pcm crc32c_intel ghash_clmulni_intel rfkill i2c_i801
snd_timer shpchp snd serio_raw mei_me lpc_ich soundcore mei tpm_tis
tpm wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc i915
rtsx_usb_sdmmc mmc_core 8021q uas garp stp i2c_algo_bit llc mrp
drm_kms_helper usb_storage drm rtsx_usb mfd_core r8169 mii video
CPU: 1 PID: 25 Comm: kworker/1:2 Not tainted 3.20.0-0.rc0.git7.3.fc22.x86_64 #1
Hardware name: WB WB-B06211/WB-B0621, BIOS EB062IWB V1.0 12/12/2013
Workqueue: events rtsx_usb_ms_handle_req [rtsx_usb_ms]
 0000000000000000 000000003d188e66 ffff8801199e3808 ffffffff8187642b
 0000000000000000 ffff8801199e3860 ffff8801199e3848 ffffffff810ab39a
 ffff8801199e3864 ffff8801199e3cef ffff880119b57098 ffff880119b37320
Call Trace:
 [<ffffffff8187642b>] dump_stack+0x4c/0x65
 [<ffffffff810ab39a>] warn_slowpath_common+0x8a/0xc0
 [<ffffffff810ab425>] warn_slowpath_fmt+0x55/0x70
 [<ffffffff8187efe6>] ? _raw_spin_unlock_irqrestore+0x36/0x70
 [<ffffffff81453156>] check_for_stack+0x96/0xe0
 [<ffffffff81453934>] debug_dma_map_page+0x104/0x150
 [<ffffffff81613b86>] usb_hcd_map_urb_for_dma+0x646/0x790
 [<ffffffff81614165>] usb_hcd_submit_urb+0x1d5/0xa90
 [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
 [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
 [<ffffffff81103a15>] ? lockdep_init_map+0x65/0x5d0
 [<ffffffff81615d7e>] usb_submit_urb+0x42e/0x5f0
 [<ffffffff81616787>] usb_start_wait_urb+0x77/0x190
 [<ffffffff8124f035>] ? __kmalloc+0x205/0x2d0
 [<ffffffff8161697c>] usb_control_msg+0xdc/0x130
 [<ffffffffa0031669>] rtsx_usb_ep0_read_register+0x59/0x70 [rtsx_usb]
 [<ffffffffa00310c1>] ? rtsx_usb_get_rsp+0x41/0x50 [rtsx_usb]
 [<ffffffffa071da4e>] rtsx_usb_ms_handle_req+0x7ce/0x9c5 [rtsx_usb_ms]

Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-03-12 09:27:41 +00:00
Roger Tseng
bb400d2120 mfd: rtsx_usb: Defer autosuspend while card exists
A card insertion happens after the lastest polling before reader is
suspended may never have a chance to be detected. Under current 1-HZ
polling interval setting in mmc_core, the worst case of such
undetectablility is about 1 second.

To further reduce the undetectability, detect card slot again in suspend
method and defer the autosuspend if the slot is loaded. The default 2
second autosuspend delay of USB subsystem should let the next polling
detects the card.

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-01-22 16:08:02 +00:00
Roger Tseng
b166010f6a mfd: rtsx_usb: Fix runtime PM deadlock
sd_set_power_mode() in derived module drivers/mmc/host/rtsx_usb_sdmmc.c
acquires dev_mutex and then calls pm_runtime_get_sync() to make sure the
device is awake while initializing a newly inserted card. Once it is
called during suspending state and explicitly before rtsx_usb_suspend()
acquires the same dev_mutex, both routine deadlock and further hang the
driver because pm_runtime_get_sync() waits the pending PM operations.

Fix this by using an empty suspend method. mmc_core always turns the
LED off after a request is done and thus it is ok to remove the only
rtsx_usb_turn_off_led() here.

Cc: <stable@vger.kernel.org> # v3.16+
Fixes: 730876be25 ("mfd: Add realtek USB card reader driver")
Signed-off-by: Roger Tseng <rogerable@realtek.com>
[Lee: Removed newly unused variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2015-01-20 12:52:55 +00:00
Johan Hovold
1ab589c72e mfd: Use mfd_add_hotplug_devices() helper
Use mfd_add_hotplug_devices helper to register the subdevices.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-11-25 16:18:42 +00:00
Hans Wennborg
5e9bbf17b3 mfd: rtsx_usb: Fix decimal printf format specifiers prefixed with 0x
The prefix suggests the number should be printed in hex, so use
the %x specifier to do that.

Found by using regex suggested by Joe Perches.

Signed-off-by: Hans Wennborg <hans@hanshq.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-09-26 08:15:38 +01:00
Jeff Mahoney
1813908986 drivers/mfd/rtsx_usb.c: export device table
The rtsx_usb driver contains the table for the devices it supports but
doesn't export it.  As a result, no alias is generated and it doesn't
get loaded automatically.

Via https://bugzilla.novell.com/show_bug.cgi?id=890096

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reported-by: Marcel Witte <wittemar@googlemail.com>
Cc: Roger Tseng <rogerable@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-08-14 10:56:15 -06:00
Krzysztof Kozlowski
9031a93918 mfd: rtsx_usb: Make mfd_cell array const
mfd_add_devices() expects array of struct mfd_cell to be const.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Acked-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-06-03 08:11:39 +01:00
Roger Tseng
5f03342052 mfd: rtsx_usb: Add comment in rtsx_usb_suspend
Explain why there is no need to have a symmetric LED turn-on in resume handler
while calling rtsx_usb_turn_off_led() in suspend handler.

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-04-28 11:01:18 +01:00
Roger Tseng
fea52b8910 mfd: rtsx_usb: Fix possible race condition
Fix two possible race condition generated by misuse of del_timer in
rtsx_usb_bulk_transfer_sglist() and uninitialized timers before mfd_add_devices
in rtsx_usb_probe().

Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-04-28 11:00:57 +01:00
Roger Tseng
730876be25 mfd: Add realtek USB card reader driver
Realtek USB card reader provides a channel to transfer command or data to flash
memory cards. This driver exports host instances for mmc and memstick subsystems
and handles basic works.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2014-03-19 08:58:18 +00:00