diff mbox

[1/1] mmc: dw_mmc: Fix NULL pointer dereference

Message ID 1389781753-28217-1-git-send-email-sachin.kamat@linaro.org (mailing list archive)
State New, archived
Headers show

Commit Message

Sachin Kamat Jan. 15, 2014, 10:29 a.m. UTC
If mrq->sbc is not NULL but data->stop happens to be NULL,
it will lead to NULL pointer dereferencing. Avoid this by
having a NULL check for data->stop.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
---
 drivers/mmc/host/dw_mmc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Seungwon Jeon Jan. 15, 2014, 11:59 a.m. UTC | #1
On Wed, January 15, 2014, Sachin Kamat wrote:
> If mrq->sbc is not NULL but data->stop happens to be NULL,
> it will lead to NULL pointer dereferencing. Avoid this by
> having a NULL check for data->stop.
> 
> Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>

Although there is actually no case in mrq->sbc is not NULL and  data->stop NULL from mmc's block,
this change is desirable.

Acked-by: Seungwon Jeon <tgih.jun@samsung.com>

Thanks,
Seungwon Jeon

> ---
>  drivers/mmc/host/dw_mmc.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
> index 9ded62c8225e..8b3e58a5f9ed 100644
> --- a/drivers/mmc/host/dw_mmc.c
> +++ b/drivers/mmc/host/dw_mmc.c
> @@ -1345,7 +1345,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
> 
>  			if (!err) {
>  				if (!data->stop || mrq->sbc) {
> -					if (mrq->sbc)
> +					if (mrq->sbc && data->stop)
>  						data->stop->error = 0;
>  					dw_mci_request_end(host, mrq);
>  					goto unlock;
> --
> 1.7.9.5
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 9ded62c8225e..8b3e58a5f9ed 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1345,7 +1345,7 @@  static void dw_mci_tasklet_func(unsigned long priv)
 
 			if (!err) {
 				if (!data->stop || mrq->sbc) {
-					if (mrq->sbc)
+					if (mrq->sbc && data->stop)
 						data->stop->error = 0;
 					dw_mci_request_end(host, mrq);
 					goto unlock;