Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5355845e authored by Asutosh Das's avatar Asutosh Das Committed by Subhash Jadavani
Browse files

mmc: core: Check for NULL pointer access in ioctl 



Added checks to check if card is NULL before accessing it.

CRs-Fixed: 548450
Change-Id: Idc005b8420a78b3566164102fbeaa243a8e73c7c
Signed-off-by: default avatarAsutosh Das <asutoshd@codeaurora.org>
[subhashj@codeaurora.org: fixed trivial merge conflicts]
Signed-off-by: default avatarSubhash Jadavani <subhashj@codeaurora.org>
parent 0c758bb6

drivers/mmc/card/block.c

+2 −3
Original line number Diff line number Diff line
@@ -868,9 +868,8 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, 
	int err = 0, ioc_err = 0;



	idata = mmc_blk_ioctl_copy_from_user(ic_ptr);

	if (IS_ERR(idata))

	if (IS_ERR_OR_NULL(idata))

		return PTR_ERR(idata);



	md = mmc_blk_get(bdev->bd_disk);

	if (!md) {

		err = -EINVAL;
@@ -878,7 +877,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, 
	}



	card = md->queue.card;

	if (IS_ERR(card)) {

	if (IS_ERR_OR_NULL(card)) {

		err = PTR_ERR(card);

		goto cmd_done;

	}

drivers/mmc/core/core.c

+4 −0
Original line number Diff line number Diff line
@@ -876,6 +876,10 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) 
{

	unsigned int mult;



	if (!card) {

		WARN_ON(1);

		return;

	}

	/*

	 * SDIO cards only define an upper 1 s limit on access.

	 */