Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 770d7432 authored by Adrian Hunter's avatar Adrian Hunter Committed by Chris Ball
Browse files

mmc: omap_hsmmc: fix oops in omap_hsmmc_dma_cb() 



In the case of an I/O error, the DMA will have been cleaned up in
the MMC interrupt and the request structure pointer will be null.

In that case, it is essential to check if the DMA is over before
dereferencing host->mrq->data.

Signed-off-by: default avatarAdrian Hunter <adrian.hunter@nokia.com>
Signed-off-by: default avatarChris Ball <cjb@laptop.org>
parent 3796fb8a

drivers/mmc/host/omap_hsmmc.c

+2 −1
Original line number Diff line number Diff line
@@ -1369,7 +1369,7 @@ static void omap_hsmmc_config_dma_params(struct omap_hsmmc_host *host, 
static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data)

{

	struct omap_hsmmc_host *host = cb_data;

	struct mmc_data *data = host->mrq->data;

	struct mmc_data *data;

	int dma_ch, req_in_progress;



	if (!(ch_status & OMAP_DMA_BLOCK_IRQ)) {
@@ -1384,6 +1384,7 @@ static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data) 
		return;

	}



	data = host->mrq->data;

	host->dma_sg_idx++;

	if (host->dma_sg_idx < host->dma_len) {

		/* Fire up the next transfer. */