--- /dev/null
+From 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 Mon Sep 17 00:00:00 2001
+From: Yibin Ding <yibin.ding@unisoc.com>
+Date: Wed, 2 Aug 2023 10:30:23 +0800
+Subject: mmc: block: Fix in_flight[issue_type] value error
+
+From: Yibin Ding <yibin.ding@unisoc.com>
+
+commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 upstream.
+
+For a completed request, after the mmc_blk_mq_complete_rq(mq, req)
+function is executed, the bitmap_tags corresponding to the
+request will be cleared, that is, the request will be regarded as
+idle. If the request is acquired by a different type of process at
+this time, the issue_type of the request may change. It further
+caused the value of mq->in_flight[issue_type] to be abnormal,
+and a large number of requests could not be sent.
+
+p1: p2:
+mmc_blk_mq_complete_rq
+ blk_mq_free_request
+ blk_mq_get_request
+ blk_mq_rq_ctx_init
+mmc_blk_mq_dec_in_flight
+ mmc_issue_type(mq, req)
+
+This strategy can ensure the consistency of issue_type
+before and after executing mmc_blk_mq_complete_rq.
+
+Fixes: 81196976ed94 ("mmc: block: Add blk-mq support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yibin Ding <yibin.ding@unisoc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230802023023.1318134-1-yunlong.xing@unisoc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1976,15 +1976,16 @@ static void mmc_blk_mq_poll_completion(s
+ mmc_blk_urgent_bkops(mq, mqrq);
+ }
+
+-static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, struct request *req)
++static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq,
++ struct request_queue *q,
++ enum mmc_issue_type issue_type)
+ {
+- struct request_queue *q = req->q;
+ unsigned long flags;
+ bool put_card;
+
+ spin_lock_irqsave(q->queue_lock, flags);
+
+- mq->in_flight[mmc_issue_type(mq, req)] -= 1;
++ mq->in_flight[issue_type] -= 1;
+
+ put_card = (mmc_tot_in_flight(mq) == 0);
+
+@@ -1996,9 +1997,11 @@ static void mmc_blk_mq_dec_in_flight(str
+
+ static void mmc_blk_mq_post_req(struct mmc_queue *mq, struct request *req)
+ {
++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
+ struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
+ struct mmc_request *mrq = &mqrq->brq.mrq;
+ struct mmc_host *host = mq->card->host;
++ struct request_queue *q = req->q;
+
+ mmc_post_req(host, mrq, 0);
+
+@@ -2011,7 +2014,7 @@ static void mmc_blk_mq_post_req(struct m
+ else
+ blk_mq_complete_request(req);
+
+- mmc_blk_mq_dec_in_flight(mq, req);
++ mmc_blk_mq_dec_in_flight(mq, q, issue_type);
+ }
+
+ void mmc_blk_mq_recovery(struct mmc_queue *mq)