[PATCH] mmc: block: Mark the end of a truncated scatterlist

[PATCH] mmc: block: Mark the end of a truncated scatterlist

[Zhu Ling]

mmc_blk_data_prep() maps the remaining block request before trimming the
scatterlist to the size of the current transfer, for example during
single-block error recovery.

When the transfer needs fewer SG entries, the trimming updates sg_len and
the length of the final retained entry but leaves SG_END on the original
last entry. A host calling sg_last(data->sg, data->sg_len) on this list
will hit its end-marker assertion.

This assertion was reported during read recovery with a Phytium host
driver in a vendor Linux 6.6 kernel. The same trimming logic is present in
mainline.

Mark the final retained entry as the end of the scatterlist. Subsequent
blk_rq_map_sg() calls can still extend the list: blk_next_sg() clears
premature end markers before advancing to the next entry.

Fixes: 6a79e391df29 ("mmc_block: ensure all sectors that do not have errors are read")
Signed-off-by: Zhu Ling <zhuling2709@phytium.com.cn>
---
1. I could not find an MMC-specific statement explicitly permitting an
   unterminated SG prefix. Feedback from MMC maintainers on this
   interpretation would be appreciated.

2. bcm2835_prepare_dma() checks sg_is_last() before dma_map_sg().
   No failure has been reproduced with that driver.

3. A userspace metadata reproducer triggers the sg_last() assertion with
   the original trimming loop. With this change, 120 flat-SG cases and
   36 chained-SG cases pass, including truncation boundaries and rebuilding
   a longer list.

 drivers/mmc/core/block.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1506,6 +1506,7 @@
 			data_size -= sg->length;
 			if (data_size <= 0) {
 				sg->length += data_size;
+				sg_mark_end(sg);
 				i++;
 				break;
 			}