lkml.org 
[lkml]   [2011]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[030/143] mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Ben Dooks <ben-linux@fluff.org>

    commit b7b4d3426d2b5ecab21578eb20d8e456a1aace8f upstream.

    It seems that under certain circumstances that the sdhci_tasklet_finish()
    call can be entered with mrq->cmd set to NULL, causing the system to crash
    with a NULL pointer de-reference.

    Unable to handle kernel NULL pointer dereference at virtual address 00000000
    PC is at sdhci_tasklet_finish+0x34/0xe8
    LR is at sdhci_tasklet_finish+0x24/0xe8

    Seen on S3C6410 system.

    Signed-off-by: Ben Dooks <ben-linux@fluff.org>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/mmc/host/sdhci.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/mmc/host/sdhci.c
    +++ b/drivers/mmc/host/sdhci.c
    @@ -1277,7 +1277,7 @@ static void sdhci_tasklet_finish(unsigne
    * upon error conditions.
    */
    if (!(host->flags & SDHCI_DEVICE_DEAD) &&
    - (mrq->cmd->error ||
    + ((mrq->cmd && mrq->cmd->error) ||
    (mrq->data && (mrq->data->error ||
    (mrq->data->stop && mrq->data->stop->error))) ||
    (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {



    \
     
     \ /
      Last update: 2011-05-06 03:03    [W:4.255 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site