mmc: sdhci: plug DMA mapping leak on error

commit 054cedff5e025a54ceefff891c6ea42ee8b37eab upstream.

If we terminate a command early, we fail to properly clean up the DMA
mappings for the data part of the request.  Put this clean up to the
tasklet, which is the common path for finishing a request so we always
clean up after ourselves.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[ Split original patch so that it now contains only the fix ]
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Tested-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 23a549540a9777a6aa483886893295adaf37a340..e0d2059e156abffb6a56a3837e54e028aaac0222 100644 (file)
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2206,6 +2206,22 @@ static void sdhci_tasklet_finish(unsigned long param)
 
        mrq = host->mrq;
 
+       /*
+        * Always unmap the data buffers if they were mapped by
+        * sdhci_prepare_data() whenever we finish with a request.
+        * This avoids leaking DMA mappings on error.
+        */
+       if (host->flags & SDHCI_REQ_USE_DMA) {
+               struct mmc_data *data = mrq->data;
+
+               if (data && data->host_cookie == COOKIE_MAPPED) {
+                       dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+                                    (data->flags & MMC_DATA_READ) ?
+                                    DMA_FROM_DEVICE : DMA_TO_DEVICE);
+                       data->host_cookie = COOKIE_UNMAPPED;
+               }
+       }
+
        /*
         * The controller needs a reset of internal state machines
         * upon error conditions.