From 6e47a4a6b2e012b1761b724d7dadfff640324ccb Mon Sep 17 00:00:00 2001 From: Matthew Ma Date: Fri, 12 Dec 2025 07:16:39 +0000 Subject: [PATCH] mmc: core: Fix kernel panic when remove non-standard SDIO card stable inclusion from stable-v4.19.264 commit 1fb79478695d92bab1c120ad3dad05252b02a29d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBMTC CVE: CVE-2022-50640 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1fb79478695d92bab1c120ad3dad05252b02a29d -------------------------------- commit 9972e6b404884adae9eec7463e30d9b3c9a70b18 upstream. SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO card has removed, which is because the card device's reference counter does not increase for it at sdio_init_func(), but all SDIO card device reference counter gets decreased at sdio_release_func(). Fixes: 6f51be3d37df ("sdio: allow non-standard SDIO cards") Signed-off-by: Matthew Ma Reviewed-by: Weizhao Ouyang Reviewed-by: John Wang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20221014034951.2300386-1-ouyangweizhao@zeku.com Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman Conflicts: drivers/mmc/core/sdio_bus.c [Only context conflicts since the commit 605d9fb9556 ("mmc: sdio: fix possible resource leaks in some error paths") is merged.] Signed-off-by: Cai Xinchen --- drivers/mmc/core/sdio_bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c index 2ee4822c9285..dd73e8e83c72 100644 --- a/drivers/mmc/core/sdio_bus.c +++ b/drivers/mmc/core/sdio_bus.c @@ -264,7 +264,8 @@ static void sdio_release_func(struct device *dev) { struct sdio_func *func = dev_to_sdio_func(dev); - sdio_free_func_cis(func); + if (!(func->card->quirks & MMC_QUIRK_NONSTD_SDIO)) + sdio_free_func_cis(func); /* * We have now removed the link to the tuples in the -- Gitee