From bc74b5f993646b08aa7ae4628fdb627f8f2fe31b Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Fri, 25 Mar 2011 15:06:19 +0900
Subject: [PATCH] --- yaml --- r: 243415 b: refs/heads/master c:
 4f665cb614b8a258b507cc47753dd3f7dd45aac6 h: refs/heads/master i:   243413:
 6bb39a069a5c5ab16289328e600b7efd99c70718   243411:
 dab7232e8731a568f2d8a96a328d3dee01b5df8f   243407:
 d1901be7f5094b4c3f8d048417c494fe30d736d7 v: v3

---
 [refs]                          |  2 +-
 trunk/drivers/mmc/core/sd_ops.c | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 9368c391532b..cd2d448bd529 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 58ac8177cebb890ba980cdace36457e0fe1e62af
+refs/heads/master: 4f665cb614b8a258b507cc47753dd3f7dd45aac6
diff --git a/trunk/drivers/mmc/core/sd_ops.c b/trunk/drivers/mmc/core/sd_ops.c
index 797cdb5887fd..76af349c14b4 100644
--- a/trunk/drivers/mmc/core/sd_ops.c
+++ b/trunk/drivers/mmc/core/sd_ops.c
@@ -9,6 +9,7 @@
  * your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/scatterlist.h>
 
@@ -252,6 +253,7 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
 	struct mmc_command cmd;
 	struct mmc_data data;
 	struct scatterlist sg;
+	void *data_buf;
 
 	BUG_ON(!card);
 	BUG_ON(!card->host);
@@ -263,6 +265,13 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
 	if (err)
 		return err;
 
+	/* dma onto stack is unsafe/nonportable, but callers to this
+	 * routine normally provide temporary on-stack buffers ...
+	 */
+	data_buf = kmalloc(sizeof(card->raw_scr), GFP_KERNEL);
+	if (data_buf == NULL)
+		return -ENOMEM;
+
 	memset(&mrq, 0, sizeof(struct mmc_request));
 	memset(&cmd, 0, sizeof(struct mmc_command));
 	memset(&data, 0, sizeof(struct mmc_data));
@@ -280,12 +289,15 @@ int mmc_app_send_scr(struct mmc_card *card, u32 *scr)
 	data.sg = &sg;
 	data.sg_len = 1;
 
-	sg_init_one(&sg, scr, 8);
+	sg_init_one(&sg, data_buf, 8);
 
 	mmc_set_data_timeout(&data, card);
 
 	mmc_wait_for_req(card->host, &mrq);
 
+	memcpy(scr, data_buf, sizeof(card->raw_scr));
+	kfree(data_buf);
+
 	if (cmd.error)
 		return cmd.error;
 	if (data.error)