[PATCH 1/5] memstick: mspro_block: don't hand a finished request back to the host

[Ho Jie Feng]

When a block request ends, mspro_block_complete_req() clears
msb->block_req, completes card->mrq_complete and returns 0.
Host drivers take a 0 return from memstick_next_req() to mean that
*mrq holds a new request, so the host issues card->current_mrq again
even though it has already finished.

At the same time, msb->block_req being NULL allows mspro_queue_rq() to
pass the check and queue another request, causing a race condition
that rewrites card->current_mrq while the host is executing it.

Return -EAGAIN instead, as the function already does when there is no
block request.

Fixes: d0be12274dad ("mspro_block: convert to blk-mq")
Signed-off-by: Ho Jie Feng <hjf3108@xxxxxxxxx>
---
 drivers/memstick/core/mspro_block.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
index 4a52830026c50..fe38b42431219 100644
--- a/drivers/memstick/core/mspro_block.c
+++ b/drivers/memstick/core/mspro_block.c
@@ -706,6 +706,8 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
 			__blk_mq_end_request(msb->block_req,
 						errno_to_blk_status(error));
 			msb->block_req = NULL;
+			if (!error)
+				error = -EAGAIN;
 		}
 	} else {
 		if (!error)
-- 
2.56.0