linux-toradex-mainline: Add MMC extcsd fixes patch

Add patches to fix MMC extcsd ioctl regression.

Related-to: ELB-5679
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>

3 files changed, 88 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-toradex-mainline-git/0001-mmc-core-block.c-initialize-mmc_blk_ioc_data.patch b/recipes-kernel/linux/linux-toradex-mainline-git/0001-mmc-core-block.c-initialize-mmc_blk_ioc_data.patch
new file mode 100644
index 0000000..0799809
--- /dev/null
+++ b/recipes-kernel/linux/linux-toradex-mainline-git/0001-mmc-core-block.c-initialize-mmc_blk_ioc_data.patch
@@ -0,0 +1,46 @@
+From 8665d5c2210040a05d26abc1ec2c81fb1cea4630 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Wed, 13 Mar 2024 15:37:43 +0200
+Subject: [PATCH 1/2] mmc core block.c: initialize mmc_blk_ioc_data
+
+Commit "mmc: core: Use mrq.sbc in close-ended ffu" adds flags uint to
+struct mmc_blk_ioc_data but it does not get initialized for RPMB ioctls
+which now fail.
+
+Fix this by always initializing the struct and flags to zero.
+
+Fixes access to RPMB storage.
+
+Upstream-Status: Submitted [https://lore.kernel.org/all/20240313133744.2405325-1-mikko.rapeli@linaro.org/]
+
+Fixes: 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218587
+Link: https://lore.kernel.org/all/20231129092535.3278-1-avri.altman@wdc.com/
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: linux-mmc@vger.kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index ea60efaecb0d..5487c71ae0df 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -415,7 +415,7 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
+ 	struct mmc_blk_ioc_data *idata;
+ 	int err;
+ 
+-	idata = kmalloc(sizeof(*idata), GFP_KERNEL);
++	idata = kzalloc(sizeof(*idata), GFP_KERNEL);
+ 	if (!idata) {
+ 		err = -ENOMEM;
+ 		goto out;
+-- 
+2.39.2
+
diff --git a/recipes-kernel/linux/linux-toradex-mainline-git/0002-mmc-core-block.c-avoid-negative-index-with-array-acc.patch b/recipes-kernel/linux/linux-toradex-mainline-git/0002-mmc-core-block.c-avoid-negative-index-with-array-acc.patch
new file mode 100644
index 0000000..69c9135
--- /dev/null
+++ b/recipes-kernel/linux/linux-toradex-mainline-git/0002-mmc-core-block.c-avoid-negative-index-with-array-acc.patch
@@ -0,0 +1,40 @@
+From b1dcce9ccd7272d9a80fb546aefca89f66c18706 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Wed, 13 Mar 2024 15:37:44 +0200
+Subject: [PATCH 2/2] mmc core block.c: avoid negative index with array access
+
+Commit "mmc: core: Use mrq.sbc in close-ended ffu" assigns
+prev_idata = idatas[i - 1] but doesn't check that int iterator
+i is greater than zero. Add the check.
+
+Upstream-Status: Submitted [https://lore.kernel.org/all/20240313133744.2405325-1-mikko.rapeli@linaro.org/]
+
+Fixes: 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu")
+Link: https://lore.kernel.org/all/20231129092535.3278-1-avri.altman@wdc.com/
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: linux-mmc@vger.kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 5487c71ae0df..e464fccbde5b 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -490,7 +490,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ 	if (idata->flags & MMC_BLK_IOC_DROP)
+ 		return 0;
+ 
+-	if (idata->flags & MMC_BLK_IOC_SBC)
++	if (idata->flags & MMC_BLK_IOC_SBC && i > 0)
+ 		prev_idata = idatas[i - 1];
+ 
+ 	/*
+-- 
+2.39.2
+
diff --git a/recipes-kernel/linux/linux-toradex-mainline_git.bb b/recipes-kernel/linux/linux-toradex-mainline_git.bb
index d0fc8a6..aa8f43a 100644
--- a/recipes-kernel/linux/linux-toradex-mainline_git.bb
+++ b/recipes-kernel/linux/linux-toradex-mainline_git.bb
@@ -53,6 +53,8 @@ SRC_URI:append = " \
     file://0001-usb-gadget-f_ncm-Apply-workaround-for-packet-cloggin.patch \
     file://0001-dt-bindings-arm-fsl-Add-toradex-apalis_imx6q-eval-v1.patch \
     file://0002-arm-dts-nxp-imx-Add-support-for-Apalis-Evaluation-Bo.patch \
+    file://0001-mmc-core-block.c-initialize-mmc_blk_ioc_data.patch \
+    file://0002-mmc-core-block.c-avoid-negative-index-with-array-acc.patch \
 "
 
 LINUX_VERSION ?= "6.1.80"