MMC core:

- Fix use-after-free issue for rpmb partition
 
 MMC host
  - Fix quirk for broken CQE support
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAl7Q5BEXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCludxAA06hfX/T9D15zMR/OX9BExyh0
 Zyx6aEQN7zRZBBkC0Hl21Hz5g+wws7ezwJkxWH4tzk7XsTT1F1shnAaf2dyG0qdM
 Ntbsd69wM5amCus7l2TesvL3epC15qWXCQcnv1RWFWz/ZYG6z3/gvv9p2mTh0TIm
 X92sbNptHgsIHdHD02GWYBkWPf3kF4b0UMp0Nc35WAzh4hbhRbNQw/7ktzmMyUD7
 iYjt2liho0PlAwrIEWpgw9whUyUBgnhO7TuvZHxwthmXWTRlDY6i9OqOKoF9FjyW
 hiOho+A5etE6GG//GgHW70yi9oziYPbmVPa9onzKBmBYQY9pilTcNm3apggwE+tl
 22QKZEi8yohajeo8x0xNvHtNEtIovYUEQe9yqXK411KPe4mz4zQbdufE0JV9Uh0s
 RCh9J+y0ge2T0o9hALN/GD2dgJHOMORebKlq+hFt6wyyKEziYGVqmzkbu4Kvojnq
 UYDy0h/ZR0etiNev/OACuft7Hs+Q7VYne1xLKTSM1VHB0LZtvk8uvqNRpCvlZ9js
 qrcCsRa7A5PCEkTvLTKdmYWcOFzmF0srr74hz0JDYuCy7OX9nEE5m/WcYOfQhUQf
 yEmiwcIFTmhfxgPBv4l3pYsf2QuRL3DtrW+wPf4Jxl9RuQjTRAgBKA0XUmIK9v9N
 5YxgDGxN6SulAqBTiG8=
 =JSSa
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v5.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix use-after-free issue for rpmb partition

  MMC host:
   - Fix quirk for broken CQE support"

* tag 'mmc-v5.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: block: Fix use-after-free issue for rpmb
  mmc: sdhci: Fix SDHCI_QUIRK_BROKEN_CQE

drivers/mmc/core/block.c

@@ -2484,8 +2484,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
 	struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
 						  struct mmc_rpmb_data, chrdev);
 
-	put_device(&rpmb->dev);
 	mmc_blk_put(rpmb->md);
+	put_device(&rpmb->dev);
 
 	return 0;
 }

drivers/mmc/host/sdhci.c

@@ -4000,9 +4000,6 @@ int sdhci_setup_host(struct sdhci_host *host)
 		       mmc_hostname(mmc), host->version);
 	}
 
-	if (host->quirks & SDHCI_QUIRK_BROKEN_CQE)
-		mmc->caps2 &= ~MMC_CAP2_CQE;
-
 	if (host->quirks & SDHCI_QUIRK_FORCE_DMA)
 		host->flags |= SDHCI_USE_SDMA;
 	else if (!(host->caps & SDHCI_CAN_DO_SDMA))
@@ -4539,6 +4536,12 @@ int __sdhci_add_host(struct sdhci_host *host)
 	struct mmc_host *mmc = host->mmc;
 	int ret;
 
+	if ((mmc->caps2 & MMC_CAP2_CQE) &&
+	    (host->quirks & SDHCI_QUIRK_BROKEN_CQE)) {
+		mmc->caps2 &= ~MMC_CAP2_CQE;
+		mmc->cqe_ops = NULL;
+	}
+
 	host->complete_wq = alloc_workqueue("sdhci", flags, 0);
 	if (!host->complete_wq)
 		return -ENOMEM;