Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c00a231b authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Ulf Hansson
Browse files

mmc: bcm2835: fix potential null pointer dereferences 



Null check at line 1165: if (mrq->cmd), implies that mrq->cmd might
be NULL.
Add null checks before dereferencing pointer mrq->cmd in order to avoid
any potential NULL pointer dereference.

Addresses-Coverity-ID: 1408740
Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
parent d63c2bf4

drivers/mmc/host/bcm2835.c

+9 −3
Original line number Diff line number Diff line
@@ -1172,7 +1172,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) 
	if (mrq->data && !is_power_of_2(mrq->data->blksz)) {

		dev_err(dev, "unsupported block size (%d bytes)\n",

			mrq->data->blksz);



		if (mrq->cmd)

			mrq->cmd->error = -EINVAL;



		mmc_request_done(mmc, mrq);

		return;

	}
@@ -1194,7 +1197,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) 
			readl(host->ioaddr + SDCMD) & SDCMD_CMD_MASK,

			edm);

		bcm2835_dumpregs(host);



		if (mrq->cmd)

			mrq->cmd->error = -EILSEQ;



		bcm2835_finish_request(host);

		mutex_unlock(&host->mutex);

		return;
@@ -1207,7 +1213,7 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) 
			if (!host->use_busy)

				bcm2835_finish_command(host);

		}

	} else if (bcm2835_send_command(host, mrq->cmd)) {

	} else if (mrq->cmd && bcm2835_send_command(host, mrq->cmd)) {

		if (host->data && host->dma_desc) {

			/* DMA transfer starts now, PIO starts after irq */

			bcm2835_start_dma(host);