From patchwork Wed Apr 27 13:24:19 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 735811 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p3RDNNaq017547 for ; Wed, 27 Apr 2011 13:24:24 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759194Ab1D0NYY (ORCPT ); Wed, 27 Apr 2011 09:24:24 -0400 Received: from opensource.wolfsonmicro.com ([80.75.67.52]:60859 "EHLO opensource2.wolfsonmicro.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1759152Ab1D0NYX (ORCPT ); Wed, 27 Apr 2011 09:24:23 -0400 Received: from finisterre.wolfsonmicro.main (unknown [87.246.78.26]) by opensource2.wolfsonmicro.com (Postfix) with ESMTPSA id 8A42D11018E; Wed, 27 Apr 2011 14:24:22 +0100 (BST) Received: from broonie by finisterre.wolfsonmicro.main with local (Exim 4.74) (envelope-from ) id 1QF4jI-0005cg-Di; Wed, 27 Apr 2011 14:24:32 +0100 From: Mark Brown To: Chris Ball Cc: linux-mmc@vger.kernel.org, Ben Dooks , Dimitris Papastamos , Mark Brown Subject: [PATCH 1/2] MMC: SDHCI: Check mrq->cmd in sdhci_tasklet_finish Date: Wed, 27 Apr 2011 14:24:19 +0100 Message-Id: <1303910660-21583-1-git-send-email-broonie@opensource.wolfsonmicro.com> X-Mailer: git-send-email 1.7.4.1 Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 27 Apr 2011 13:24:24 +0000 (UTC) From: Ben Dooks It seems that under certain circumstances that the sdhci_tasklet_finish() call can be entered with mrq->cmd set to NULL, causing the system to crash with a NULL pointer de-reference. Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at sdhci_tasklet_finish+0x34/0xe8 LR is at sdhci_tasklet_finish+0x24/0xe8 Seen on S3C6410 system. Signed-off-by: Ben Dooks Signed-off-by: Mark Brown --- drivers/mmc/host/sdhci.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c index f70e21e..5553829 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c @@ -1384,7 +1384,7 @@ static void sdhci_tasklet_finish(unsigned long param) * upon error conditions. */ if (!(host->flags & SDHCI_DEVICE_DEAD) && - (mrq->cmd->error || + ((mrq->cmd && mrq->cmd->error) || (mrq->data && (mrq->data->error || (mrq->data->stop && mrq->data->stop->error))) || (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {