mmc: bcm2835: Avoid possible races on data requests

There are two accesses on the data requests which are not protected by
the mutex. So fix this accordingly.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 0711e251940c545bee45c63cf6d18b62996d16c3..cdfc24f1093b88ba03b47b863d59e38d42f05968 100644 (file)
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1053,10 +1053,12 @@ static void bcm2835_dma_complete_work(struct work_struct *work)
 {
        struct bcm2835_host *host =
                container_of(work, struct bcm2835_host, dma_work);
-       struct mmc_data *data = host->data;
+       struct mmc_data *data;
 
        mutex_lock(&host->mutex);
 
+       data = host->data;
+
        if (host->dma_chan) {
                dma_unmap_sg(host->dma_chan->device->dev,
                             data->sg, data->sg_len,
@@ -1181,9 +1183,6 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
                return;
        }
 
-       if (host->use_dma && mrq->data && (mrq->data->blocks > PIO_THRESHOLD))
-               bcm2835_prepare_dma(host, mrq->data);
-
        mutex_lock(&host->mutex);
 
        WARN_ON(host->mrq);
@@ -1207,6 +1206,9 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
                return;
        }
 
+       if (host->use_dma && mrq->data && (mrq->data->blocks > PIO_THRESHOLD))
+               bcm2835_prepare_dma(host, mrq->data);
+
        host->use_sbc = !!mrq->sbc && host->mrq->data &&
                        (host->mrq->data->flags & MMC_DATA_READ);
        if (host->use_sbc) {