Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 62773136 authored by Siba Prasad's avatar Siba Prasad Committed by Pradeep P V K
Browse files

mmc: card: Fix NULL pointer dereference in mmc_blk_ioctl_rpmb_cmd() 



In mmc_blk_ioctl_rpmb_cmd(), if user data copy fails, the card
variable is dereferenced without NULL pointer check.
Adding NULL pointer check in this condition.

Change-Id: If3fd2175946cccaf838768d45de72bc2f5c32f6b
Signed-off-by: default avatarSiba Prasad <sibap@codeaurora.org>
Signed-off-by: default avatarPradeep P V K <ppvk@codeaurora.org>
parent 15208b86

drivers/mmc/card/block.c

+2 −2
Original line number Diff line number Diff line
@@ -817,7 +817,7 @@ static int mmc_blk_ioctl_rpmb_cmd(struct block_device *bdev, 
{

	struct mmc_blk_ioc_rpmb_data *idata;

	struct mmc_blk_data *md;

	struct mmc_card *card;

	struct mmc_card *card = NULL;

	struct mmc_command cmd = {0};

	struct mmc_data data = {0};

	struct mmc_request mrq = {NULL};
@@ -973,7 +973,7 @@ idata_free: 


cmd_done:

	mmc_blk_put(md);

	if (card->cmdq_init)

	if (card && card->cmdq_init)

		wake_up(&card->host->cmdq_ctx.wait);

	return err;

}