Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25e1897b authored by Balaji T K's avatar Balaji T K Committed by Chris Ball
Browse files

mmc: omap_hsmmc: Fix Oops in case of data errors 



ae4bf788 ("mmc: omap_hsmmc: consolidate error report handling of HSMMC
IRQ") sets both end_cmd and end_trans to 1.

Setting end_cmd to 1 for Data Timeout/CRC leads to NULL pointer dereference of
host->cmd as the command complete has previously been handled.
Set end_cmd only in case of command Timeout/CRC.

Moreover host->cmd->error should not be updated on data error case, only
host->data->error needs to be updated.

Signed-off-by: default avatarBalaji T K <balajitk@ti.com>
Reviewed-by: default avatarFelipe Balbi <balbi@ti.com>
Signed-off-by: default avatarVenkatraman S <svenkatr@ti.com>
Signed-off-by: default avatarChris Ball <cjb@laptop.org>
parent ab269128

drivers/mmc/host/omap_hsmmc.c

+12 −6
Original line number Diff line number Diff line
@@ -969,10 +969,14 @@ static inline void omap_hsmmc_reset_controller_fsm(struct omap_hsmmc_host *host, 
			__func__);

}



static void hsmmc_command_incomplete(struct omap_hsmmc_host *host, int err)

static void hsmmc_command_incomplete(struct omap_hsmmc_host *host,

					int err, int end_cmd)

{

	omap_hsmmc_reset_controller_fsm(host, SRC);

	if (end_cmd) {

		if (host->cmd)

			host->cmd->error = err;

	}



	if (host->data) {

		omap_hsmmc_reset_controller_fsm(host, SRD);
@@ -991,14 +995,16 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status) 


	if (status & ERR) {

		omap_hsmmc_dbg_report_irq(host, status);



		if (status & (CMD_TIMEOUT | CMD_CRC))

			end_cmd = 1;

		if (status & (CMD_TIMEOUT | DATA_TIMEOUT))

			hsmmc_command_incomplete(host, -ETIMEDOUT);

			hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);

		else if (status & (CMD_CRC | DATA_CRC))

			hsmmc_command_incomplete(host, -EILSEQ);

			hsmmc_command_incomplete(host, -EILSEQ, end_cmd);



		end_cmd = 1;

		if (host->data || host->response_busy) {

			end_trans = 1;

			end_trans = !end_cmd;

			host->response_busy = 0;

		}

	}