From patchwork Wed Apr 27 13:24:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 735821 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p3RDNNar017547 for ; Wed, 27 Apr 2011 13:24:24 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759152Ab1D0NYY (ORCPT ); Wed, 27 Apr 2011 09:24:24 -0400 Received: from opensource.wolfsonmicro.com ([80.75.67.52]:60862 "EHLO opensource2.wolfsonmicro.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1759185Ab1D0NYX (ORCPT ); Wed, 27 Apr 2011 09:24:23 -0400 Received: from finisterre.wolfsonmicro.main (unknown [87.246.78.26]) by opensource2.wolfsonmicro.com (Postfix) with ESMTPSA id 95CCF110619; Wed, 27 Apr 2011 14:24:22 +0100 (BST) Received: from broonie by finisterre.wolfsonmicro.main with local (Exim 4.74) (envelope-from ) id 1QF4jI-0005ci-Nz; Wed, 27 Apr 2011 14:24:32 +0100 From: Mark Brown To: Chris Ball Cc: linux-mmc@vger.kernel.org, Ben Dooks , Dimitris Papastamos , Mark Brown Subject: [PATCH 2/2] MMC: SDHCI: Check mrq != NULL in sdhci_tasklet_finish Date: Wed, 27 Apr 2011 14:24:20 +0100 Message-Id: <1303910660-21583-2-git-send-email-broonie@opensource.wolfsonmicro.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1303910660-21583-1-git-send-email-broonie@opensource.wolfsonmicro.com> References: <1303910660-21583-1-git-send-email-broonie@opensource.wolfsonmicro.com> Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 27 Apr 2011 13:24:25 +0000 (UTC) From: Dimitris Papastamos It seems that under certain circumstances the sdhci_tasklet_finish() call can be entered with mrq set to NULL, causing the system to crash with a NULL pointer de-reference. Seen on S3C6410 system. Signed-off-by: Dimitris Papastamos Signed-off-by: Mark Brown --- drivers/mmc/host/sdhci.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c index 5553829..5c85352 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c @@ -1384,7 +1384,7 @@ static void sdhci_tasklet_finish(unsigned long param) * upon error conditions. */ if (!(host->flags & SDHCI_DEVICE_DEAD) && - ((mrq->cmd && mrq->cmd->error) || + mrq && ((mrq->cmd && mrq->cmd->error) || (mrq->data && (mrq->data->error || (mrq->data->stop && mrq->data->stop->error))) || (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {