mmc: fix mmc_app_send_scr() for dma transfer

This patch is based on the commit "af51715079e7fb6b290e1881d63d815dc4de5011":

* Bugfix to that mmc_send_cxd_data() code: dma-to-stack is
unsafe/nonportable, so kmalloc a bounce buffer instead.

The driver may invalidate the mmc_card->csd when host driver uses dma.
So this subroutine also needs a kmalloc buffer.

Signed-off-by: Yoshihiro Shimoda <[e-mail]>
Signed-off-by: Chris Ball <[e-mail]>

drivers/mmc/core/sd_ops.c

···
  * your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/scatterlist.h>
 
···
 	struct mmc_command cmd;
 	struct mmc_data data;
 	struct scatterlist sg;
+	void *data_buf;
 
 	BUG_ON(!card);
 	BUG_ON(!card->host);
···
 	err = mmc_app_cmd(card->host, card);
 	if (err)
 		return err;
+
+	/* dma onto stack is unsafe/nonportable, but callers to this
+	 * routine normally provide temporary on-stack buffers ...
+	 */
+	data_buf = kmalloc(sizeof(card->raw_scr), GFP_KERNEL);
+	if (data_buf == NULL)
+		return -ENOMEM;
 
 	memset(&mrq, 0, sizeof(struct mmc_request));
 	memset(&cmd, 0, sizeof(struct mmc_command));
···
 	data.sg = &sg;
 	data.sg_len = 1;
 
-	sg_init_one(&sg, scr, 8);
+	sg_init_one(&sg, data_buf, 8);
 
 	mmc_set_data_timeout(&data, card);
 
 	mmc_wait_for_req(card->host, &mrq);
+
+	memcpy(scr, data_buf, sizeof(card->raw_scr));
+	kfree(data_buf);
 
 	if (cmd.error)
 		return cmd.error;