LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Raul E Rangel <rrangel@chromium.org>,
	Avri Altman <avri.altman@wdc.com>,
	Ulf Hansson <ulf.hansson@linaro.org>,
	Sasha Levin <sashal@kernel.org>,
	linux-mmc@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 003/114] mmc: core: Verify SD bus width
Date: Wed, 22 May 2019 15:28:26 -0400	[thread overview]
Message-ID: <20190522193017.26567-3-sashal@kernel.org> (raw)
In-Reply-To: <20190522193017.26567-1-sashal@kernel.org>

From: Raul E Rangel <rrangel@chromium.org>

[ Upstream commit 9e4be8d03f50d1b25c38e2b59e73b194c130df7d ]

The SD Physical Layer Spec says the following: Since the SD Memory Card
shall support at least the two bus modes 1-bit or 4-bit width, then any SD
Card shall set at least bits 0 and 2 (SD_BUS_WIDTH="0101").

This change verifies the card has specified a bus width.

AMD SDHC Device 7806 can get into a bad state after a card disconnect
where anything transferred via the DATA lines will always result in a
zero filled buffer. Currently the driver will continue without error if
the HC is in this condition. A block device will be created, but reading
from it will result in a zero buffer. This makes it seem like the SD
device has been erased, when in actuality the data is never getting
copied from the DATA lines to the data buffer.

SCR is the first command in the SD initialization sequence that uses the
DATA lines. By checking that the response was invalid, we can abort
mounting the card.

Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Raul E Rangel <rrangel@chromium.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/sd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index f09148a4ab557..00ba8807dafe4 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -214,6 +214,14 @@ static int mmc_decode_scr(struct mmc_card *card)
 
 	if (scr->sda_spec3)
 		scr->cmds = UNSTUFF_BITS(resp, 32, 2);
+
+	/* SD Spec says: any SD Card shall set at least bits 0 and 2 */
+	if (!(scr->bus_widths & SD_SCR_BUS_WIDTH_1) ||
+	    !(scr->bus_widths & SD_SCR_BUS_WIDTH_4)) {
+		pr_err("%s: invalid bus width\n", mmc_hostname(card->host));
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
-- 
2.20.1


  parent reply	other threads:[~2019-05-22 19:30 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-22 19:28 [PATCH AUTOSEL 4.9 001/114] gfs2: Fix lru_count going negative Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 002/114] cxgb4: Fix error path in cxgb4_init_module Sasha Levin
2019-05-22 19:28 ` Sasha Levin [this message]
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 004/114] dmaengine: tegra210-dma: free dma controller in remove() Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 005/114] net: ena: gcc 8: fix compilation warning Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 006/114] orangefs: truncate before updating size Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 007/114] ASoC: hdmi-codec: unlock the device on startup errors Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 008/114] powerpc/boot: Fix missing check of lseek() return value Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 009/114] ASoC: imx: fix fiq dependencies Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 010/114] spi: pxa2xx: fix SCR (divisor) calculation Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 011/114] brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 012/114] ARM: vdso: Remove dependency with the arch_timer driver internals Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 013/114] arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 014/114] sched/cpufreq: Fix kobject memleak Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 015/114] scsi: qla2xxx: Fix a qla24xx_enable_msix() error path Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 016/114] iwlwifi: pcie: don't crash on invalid RX interrupt Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 017/114] rtc: 88pm860x: prevent use-after-free on device remove Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 018/114] w1: fix the resume command API Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 019/114] dmaengine: pl330: _stop: clear interrupt status Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 020/114] mac80211/cfg80211: update bss channel on channel switch Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 021/114] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 022/114] ASoC: fsl_sai: Update is_slave_mode with correct value Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 023/114] mwifiex: prevent an array overflow Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 024/114] net: cw1200: fix a NULL pointer dereference Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 025/114] at76c50x-usb: Don't register led_trigger if usb_register_driver failed Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 026/114] ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 027/114] crypto: sun4i-ss - Fix invalid calculation of hash end Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 028/114] bcache: return error immediately in bch_journal_replay() Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 029/114] bcache: fix failure in journal relplay Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 030/114] bcache: add failure check to run_cache_set() for journal replay Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 031/114] bcache: avoid clang -Wunintialized warning Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 032/114] RDMA/cma: Consider scope_id while binding to ipv6 ll address Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 033/114] x86/build: Move _etext to actual end of .text Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 034/114] smpboot: Place the __percpu annotation correctly Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 035/114] x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() Sasha Levin
2019-05-22 19:28 ` [PATCH AUTOSEL 4.9 036/114] mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 037/114] HID: logitech-hidpp: use RAP instead of FAP to get the protocol version Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 038/114] pinctrl: pistachio: fix leaked of_node references Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 039/114] dmaengine: at_xdmac: remove BUG_ON macro in tasklet Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 040/114] media: coda: clear error return value before picture run Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 041/114] media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper Sasha Levin
2019-05-22 19:29 ` [PATCH AUTOSEL 4.9 042/114] media: au0828: stop video streaming only when last user stops Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190522193017.26567-3-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=avri.altman@wdc.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mmc@vger.kernel.org \
    --cc=rrangel@chromium.org \
    --cc=stable@vger.kernel.org \
    --cc=ulf.hansson@linaro.org \
    --subject='Re: [PATCH AUTOSEL 4.9 003/114] mmc: core: Verify SD bus width' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).