On Tue, 13 Jun 2023 at 14:43, Christian Loehle CLoehle@hyperstone.com wrote:

commit 003fb0a51162d940f25fc35e70b0996a12c9e08a upstream.

Requests to the mmc layer usually come through a block device IO. The exceptions are the ioctl interface, RPMB chardev ioctl and debugfs, which issue their own blk_mq requests through blk_execute_rq and do not query the BLK_STS error but the mmcblk-internal drv_op_result. This patch ensures that drv_op_result defaults to an error and has to be overwritten by the operation to be considered successful.

The behavior leads to a bug where the request never propagates the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged) and thus may assume that their call executed successfully when it did not.

While always checking the blk_execute_rq return value would be advised, let's eliminate the error by always setting drv_op_result as -EIO to be overwritten on success (or other error)

Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests") Signed-off-by: Christian Loehle cloehle@hyperstone.com

Acked-by: Ulf Hansson ulf.hansson@linaro.org

Kind regards Uffe

---

This is for the 5.15. stable tree drivers/mmc/core/block.c | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c index ed034b93cb25..0b72096f10e6 100644 --- a/drivers/mmc/core/block.c +++ b/drivers/mmc/core/block.c @@ -265,6 +265,7 @@ static ssize_t power_ro_lock_store(struct device *dev, goto out_put; } req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;

•   req_to_mmc_queue_req(req)->drv_op_result = -EIO;
    blk_execute_rq(NULL, req, 0);
    ret = req_to_mmc_queue_req(req)->drv_op_result;
    blk_put_request(req);
  

@@ -656,6 +657,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, idatas[0] = idata; req_to_mmc_queue_req(req)->drv_op = rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;

•   req_to_mmc_queue_req(req)->drv_op_result = -EIO;
    req_to_mmc_queue_req(req)->drv_op_data = idatas;
    req_to_mmc_queue_req(req)->ioc_count = 1;
    blk_execute_rq(NULL, req, 0);
  

@@ -725,6 +727,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, } req_to_mmc_queue_req(req)->drv_op = rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;

•   req_to_mmc_queue_req(req)->drv_op_result = -EIO;
    req_to_mmc_queue_req(req)->drv_op_data = idata;
    req_to_mmc_queue_req(req)->ioc_count = num_of_cmds;
    blk_execute_rq(NULL, req, 0);
  

@@ -2784,6 +2787,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val) if (IS_ERR(req)) return PTR_ERR(req); req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;

•   req_to_mmc_queue_req(req)->drv_op_result = -EIO;
    blk_execute_rq(NULL, req, 0);
    ret = req_to_mmc_queue_req(req)->drv_op_result;
    if (ret >= 0) {
  

@@ -2822,6 +2826,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp) goto out_free; } req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;

•   req_to_mmc_queue_req(req)->drv_op_result = -EIO;
    req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
    blk_execute_rq(NULL, req, 0);
    err = req_to_mmc_queue_req(req)->drv_op_result;
  

-- 2.37.3