Commit 458d6423 authored by Christian Löhle's avatar Christian Löhle Committed by Yongqiang Liu
Browse files

mmc: block: fix read single on recovery logic 

mainline inclusion
from mainline-v5.17-rc5
commit 54309fde
category: bugfix
bugzilla: 186729, https://gitee.com/openeuler/kernel/issues/I578BN


CVE: CVE-2022-20008

--------------------------------

On reads with MMC_READ_MULTIPLE_BLOCK that fail,
the recovery handler will use MMC_READ_SINGLE_BLOCK for
each of the blocks, up to MMC_READ_SINGLE_RETRIES times each.
The logic for this is fixed to never report unsuccessful reads
as success to the block layer.

On command error with retries remaining, blk_update_request was
called with whatever value error was set last to.
In case it was last set to BLK_STS_OK (default), the read will be
reported as success, even though there was no data read from the device.
This could happen on a CRC mismatch for the response,
a card rejecting the command (e.g. again due to a CRC mismatch).
In case it was last set to BLK_STS_IOERR, the error is reported correctly,
but no retries will be attempted.

Fixes: 81196976 ("mmc: block: Add blk-mq support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarChristian Loehle <cloehle@hyperstone.com>
Reviewed-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/bc706a6ab08c4fe2834ba0c05a804672@hyperstone.com


Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>

Conflict: commit 40c96853 ("mmc: core: Enable re-use of
mmc_blk_in_tran_state()") is not backported, mmc_ready_for_data()
doesn't exist, use mmc_blk_in_tran_state() instead.
Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 37c00cf3

drivers/mmc/core/block.c

+14 −14
Original line number Diff line number Diff line
@@ -1658,12 +1658,13 @@ static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req) 
	struct mmc_card *card = mq->card;

	struct mmc_host *host = card->host;

	blk_status_t error = BLK_STS_OK;

	int retries = 0;



	do {

		u32 status;

		int err;

		int retries = 0;



		while (retries++ <= MMC_READ_SINGLE_RETRIES) {

			mmc_blk_rw_rq_prep(mqrq, card, 1, mq);



			mmc_wait_for_req(host, mrq);
@@ -1679,10 +1680,9 @@ static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req) 
					goto error_exit;

			}



		if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES)

			continue;



		retries = 0;

			if (!mrq->cmd->error)

				break;

		}



		if (mrq->cmd->error ||

		    mrq->data->error ||