From patchwork Wed Oct 19 13:33:04 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxime Ripard X-Patchwork-Id: 9384863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B742560762 for ; Wed, 19 Oct 2016 16:36:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A99A428DB1 for ; Wed, 19 Oct 2016 16:36:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9E65829481; Wed, 19 Oct 2016 16:36:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 293AD28DB1 for ; Wed, 19 Oct 2016 16:36:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751672AbcJSOK1 (ORCPT ); Wed, 19 Oct 2016 10:10:27 -0400 Received: from up.free-electrons.com ([163.172.77.33]:59523 "EHLO mail.free-electrons.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750827AbcJSOJu (ORCPT ); Wed, 19 Oct 2016 10:09:50 -0400 Received: by mail.free-electrons.com (Postfix, from userid 110) id 0098A2290C; Wed, 19 Oct 2016 15:33:19 +0200 (CEST) Received: from localhost (LStLambert-657-1-97-87.w90-63.abo.wanadoo.fr [90.63.216.87]) by mail.free-electrons.com (Postfix) with ESMTPSA id D204322914; Wed, 19 Oct 2016 15:33:04 +0200 (CEST) From: Maxime Ripard To: Ulf Hansson Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Hans de Goede , Chen-Yu Tsai , Maxime Ripard , linux-arm-kernel@lists.infradead.org Subject: [PATCH v2] mmc: sunxi: Prevent against null dereference for vmmc Date: Wed, 19 Oct 2016 15:33:04 +0200 Message-Id: <20161019133304.22915-1-maxime.ripard@free-electrons.com> X-Mailer: git-send-email 2.9.3 Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP VMMC is an optional regulator, which means that mmc_regulator_get_supply will only return an error in case of a deferred probe, but not when the regulator is not set in the DT. However, the sunxi driver assumes that VMMC is always there, and doesn't check the value of the regulator pointer before using it, which obviously leads to a (close to) null pointer dereference. Add proper checks to prevent that. Signed-off-by: Maxime Ripard Acked-by: Chen-Yu Tsai --- Changes from v1: - remove redundant error message --- drivers/mmc/host/sunxi-mmc.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c index c0a5c676d0e8..b1d1303389a7 100644 --- a/drivers/mmc/host/sunxi-mmc.c +++ b/drivers/mmc/host/sunxi-mmc.c @@ -822,10 +822,13 @@ static void sunxi_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) break; case MMC_POWER_UP: - host->ferror = mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, - ios->vdd); - if (host->ferror) - return; + if (!IS_ERR(mmc->supply.vmmc)) { + host->ferror = mmc_regulator_set_ocr(mmc, + mmc->supply.vmmc, + ios->vdd); + if (host->ferror) + return; + } if (!IS_ERR(mmc->supply.vqmmc)) { host->ferror = regulator_enable(mmc->supply.vqmmc); @@ -847,7 +850,9 @@ static void sunxi_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) case MMC_POWER_OFF: dev_dbg(mmc_dev(mmc), "power off!\n"); sunxi_mmc_reset_host(host); - mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0); + if (!IS_ERR(mmc->supply.vmmc)) + mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0); + if (!IS_ERR(mmc->supply.vqmmc) && host->vqmmc_enabled) regulator_disable(mmc->supply.vqmmc); host->vqmmc_enabled = false;