Commit fbd986cd authored Sep 09, 2013 by Rodolfo Giometti Committed by Chris Ball Sep 25, 2013

mmc: atmel-mci: fix oops in atmci_tasklet_func



In some cases, a NULL pointer dereference happens because data is NULL when
STATE_END_REQUEST case is reached in atmci_tasklet_func.

Cc: <stable@vger.kernel.org> # 3.9+
Signed-off-by: Rodolfo Giometti <giometti@enneenne.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Chris Ball <cjb@laptop.org>

parent c1fa3426

drivers/mmc/host/atmel-mci.c

+8 −6

Original line number	Diff line number	Diff line
		@@ -1810,6 +1810,7 @@ static void atmci_tasklet_func(unsigned long priv)
		if (unlikely(status)) {
		host->stop_transfer(host);
		host->data = NULL;
		if (data) {
		if (status & ATMCI_DTOE) {
		data->error = -ETIMEDOUT;
		} else if (status & ATMCI_DCRCE) {
		@@ -1818,6 +1819,7 @@ static void atmci_tasklet_func(unsigned long priv)
		data->error = -EIO;
		}
		}
		}

		atmci_request_end(host, host->mrq);
		state = STATE_IDLE;