mmc: core: fix one NULL pointer dereference after SD card is removed
After SD card is removed, the driver would mark its queue DYING to try to block further more requests from coming into the queue, then clean up its queue's queuedata by setting it to NULL. However, there can still be new requests come in right before the DYING mark is set after SD card is removed. When one new request is allocated and initialized, the queuedata would be accessed. If queuedata has been cleaned up already, NULL pointer dereference would happen. This change fixes it by checking if queuedata is NULL before accessing it, if yes, then bails out with error. mmc0: card aaaa removed Buffer I/O error on dev mmcblk0p1, logical block 1, lost async page write Unable to handle kernel NULL pointer dereference at virtual address 00000000 Mem abort info: Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgd = ffffffd7bbafa000 [0000000000000000] *pgd=0000000134331003, *pud=0000000134331003, *pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP task: ffffffd77d193380 task.stack: ffffff8047e30000 pc : mmc_init_request+0x28/0x74 lr : alloc_request_size+0x4c/0x70 ... Process MediaScannerSer (pid: 4710, stack limit = 0xffffff8047e30000) Call trace: mmc_init_request+0x28/0x74 alloc_request_size+0x4c/0x70 mempool_alloc+0x104/0x184 get_request+0x324/0x75c blk_queue_bio+0x154/0x398 generic_make_request+0xcc/0x228 submit_bio+0x13c/0x1d4. Change-Id: I1967392bd314fa49a723c08873c17bf229d33049 Signed-off-by:Can Guo <cang@codeaurora.org> Signed-off-by:
Sayali Lokhande <sayalil@codeaurora.org>
Loading
Please register or sign in to comment