Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4816d34 authored by Asutosh Das's avatar Asutosh Das
Browse files

mmc: block: check for NULL pointer before dereferencing 



mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: default avatarAsutosh Das <asutoshd@codeaurora.org>
parent 219364c5

drivers/mmc/card/block.c

+39 −6
Original line number Diff line number Diff line
@@ -210,9 +210,13 @@ static ssize_t power_ro_lock_show(struct device *dev, 
{

	int ret;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	struct mmc_card *card = md->queue.card;

	struct mmc_card *card;

	int locked = 0;



	if (!md)

		return -EINVAL;



	card = md->queue.card;

	if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PERM_WP_EN)

		locked = 2;

	else if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_EN)
@@ -238,6 +242,8 @@ static ssize_t power_ro_lock_store(struct device *dev, 
		return count;



	md = mmc_blk_get(dev_to_disk(dev));

	if (!md)

		return -EINVAL;

	card = md->queue.card;



	mmc_rpm_hold(card->host, &card->dev);
@@ -277,6 +283,9 @@ static ssize_t force_ro_show(struct device *dev, struct device_attribute *attr, 
	int ret;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));



	if (!md)

		return -EINVAL;



	ret = snprintf(buf, PAGE_SIZE, "%d",

		       get_disk_ro(dev_to_disk(dev)) ^

		       md->read_only);
@@ -291,6 +300,10 @@ static ssize_t force_ro_store(struct device *dev, struct device_attribute *attr, 
	char *end;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	unsigned long set = simple_strtoul(buf, &end, 0);



	if (!md)

		return -EINVAL;



	if (end == buf) {

		ret = -EINVAL;

		goto out;
@@ -311,6 +324,8 @@ num_wr_reqs_to_start_packing_show(struct device *dev, 
	int num_wr_reqs_to_start_packing;

	int ret;



	if (!md)

		return -EINVAL;

	num_wr_reqs_to_start_packing = md->queue.num_wr_reqs_to_start_packing;



	ret = snprintf(buf, PAGE_SIZE, "%d\n", num_wr_reqs_to_start_packing);
@@ -326,9 +341,13 @@ num_wr_reqs_to_start_packing_store(struct device *dev, 
{

	int value;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	struct mmc_card *card = md->queue.card;

	struct mmc_card *card;

	int ret = count;



	if (!md)

		return -EINVAL;



	card = md->queue.card;

	if (!card) {

		ret = -EINVAL;

		goto exit;
@@ -360,9 +379,13 @@ bkops_check_threshold_show(struct device *dev, 
				  struct device_attribute *attr, char *buf)

{

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	struct mmc_card *card = md->queue.card;

	struct mmc_card *card;

	int ret;



	if (!md)

		return -EINVAL;



	card = md->queue.card;

	if (!card)

		ret = -EINVAL;

	else
@@ -380,10 +403,14 @@ bkops_check_threshold_store(struct device *dev, 
{

	int value;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	struct mmc_card *card = md->queue.card;

	struct mmc_card *card;

	unsigned int card_size;

	int ret = count;



	if (!md)

		return -EINVAL;



	card = md->queue.card;

	if (!card) {

		ret = -EINVAL;

		goto exit;
@@ -421,6 +448,8 @@ no_pack_for_random_show(struct device *dev, 
	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	int ret;



	if (!md)

		return -EINVAL;

	ret = snprintf(buf, PAGE_SIZE, "%d\n", md->queue.no_pack_for_random);



	mmc_blk_put(md);
@@ -434,9 +463,13 @@ no_pack_for_random_store(struct device *dev, 
{

	int value;

	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

	struct mmc_card *card = md->queue.card;

	struct mmc_card *card;

	int ret = count;



	if (!md)

		return -EINVAL;



	card = md->queue.card;

	if (!card) {

		ret = -EINVAL;

		goto exit;
@@ -821,7 +854,7 @@ static int mmc_blk_ioctl_rpmb_cmd(struct block_device *bdev, 
	/* make sure this is a rpmb partition */

	if ((!md) || (!(md->area_type & MMC_BLK_DATA_AREA_RPMB))) {

		err = -EINVAL;

		goto cmd_done;

		return err;

	}



	idata = mmc_blk_ioctl_rpmb_copy_from_user(ic_ptr);