Merge "mmc: block: check for NULL pointer before dereferencing" (d0ded208) · Commits · e / devices / android_kernel_sony_msm8994

drivers/mmc/card/block.c

+39 −6

Original line number	Diff line number	Diff line
		@@ -210,9 +210,13 @@ static ssize_t power_ro_lock_show(struct device *dev,
		{
		int ret;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		struct mmc_card *card = md->queue.card;
		struct mmc_card *card;
		int locked = 0;

		if (!md)
		return -EINVAL;

		card = md->queue.card;
		if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PERM_WP_EN)
		locked = 2;
		else if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_EN)
		@@ -238,6 +242,8 @@ static ssize_t power_ro_lock_store(struct device *dev,
		return count;

		md = mmc_blk_get(dev_to_disk(dev));
		if (!md)
		return -EINVAL;
		card = md->queue.card;

		mmc_rpm_hold(card->host, &card->dev);
		@@ -277,6 +283,9 @@ static ssize_t force_ro_show(struct device dev, struct device_attribute attr,
		int ret;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));

		if (!md)
		return -EINVAL;

		ret = snprintf(buf, PAGE_SIZE, "%d",
		get_disk_ro(dev_to_disk(dev)) ^
		md->read_only);
		@@ -291,6 +300,10 @@ static ssize_t force_ro_store(struct device dev, struct device_attribute attr,
		char *end;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		unsigned long set = simple_strtoul(buf, &end, 0);

		if (!md)
		return -EINVAL;

		if (end == buf) {
		ret = -EINVAL;
		goto out;
		@@ -311,6 +324,8 @@ num_wr_reqs_to_start_packing_show(struct device *dev,
		int num_wr_reqs_to_start_packing;
		int ret;

		if (!md)
		return -EINVAL;
		num_wr_reqs_to_start_packing = md->queue.num_wr_reqs_to_start_packing;

		ret = snprintf(buf, PAGE_SIZE, "%d\n", num_wr_reqs_to_start_packing);
		@@ -326,9 +341,13 @@ num_wr_reqs_to_start_packing_store(struct device *dev,
		{
		int value;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		struct mmc_card *card = md->queue.card;
		struct mmc_card *card;
		int ret = count;

		if (!md)
		return -EINVAL;

		card = md->queue.card;
		if (!card) {
		ret = -EINVAL;
		goto exit;
		@@ -360,9 +379,13 @@ bkops_check_threshold_show(struct device *dev,
		struct device_attribute attr, char buf)
		{
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		struct mmc_card *card = md->queue.card;
		struct mmc_card *card;
		int ret;

		if (!md)
		return -EINVAL;

		card = md->queue.card;
		if (!card)
		ret = -EINVAL;
		else
		@@ -380,10 +403,14 @@ bkops_check_threshold_store(struct device *dev,
		{
		int value;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		struct mmc_card *card = md->queue.card;
		struct mmc_card *card;
		unsigned int card_size;
		int ret = count;

		if (!md)
		return -EINVAL;

		card = md->queue.card;
		if (!card) {
		ret = -EINVAL;
		goto exit;
		@@ -421,6 +448,8 @@ no_pack_for_random_show(struct device *dev,
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		int ret;

		if (!md)
		return -EINVAL;
		ret = snprintf(buf, PAGE_SIZE, "%d\n", md->queue.no_pack_for_random);

		mmc_blk_put(md);
		@@ -434,9 +463,13 @@ no_pack_for_random_store(struct device *dev,
		{
		int value;
		struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
		struct mmc_card *card = md->queue.card;
		struct mmc_card *card;
		int ret = count;

		if (!md)
		return -EINVAL;

		card = md->queue.card;
		if (!card) {
		ret = -EINVAL;
		goto exit;
		@@ -821,7 +854,7 @@ static int mmc_blk_ioctl_rpmb_cmd(struct block_device *bdev,
		/* make sure this is a rpmb partition */
		if ((!md) \|\| (!(md->area_type & MMC_BLK_DATA_AREA_RPMB))) {
		err = -EINVAL;
		goto cmd_done;
		return err;
		}

		idata = mmc_blk_ioctl_rpmb_copy_from_user(ic_ptr);