Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14efd957 authored by Chris Ball's avatar Chris Ball
Browse files

mmc: sdhci: fix NULL dereference in sdhci_request() tuning 



Commit 473b095a ("mmc: sdhci: fix incorrect command used in tuning")
introduced a NULL dereference at resume-time if an SD 3.0 host controller
raises the SDHCI_NEEDS_TUNING flag while no card is inserted.  Seen on an
OLPC XO-4 with sdhci-pxav3, but presumably affects other controllers too.

Signed-off-by: default avatarChris Ball <cjb@laptop.org>
Cc: stable <stable@vger.kernel.org> [3.3+]
parent 657d5982

drivers/mmc/host/sdhci.c

+13 −10
Original line number Diff line number Diff line
@@ -1315,8 +1315,10 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq) 
		 */

		if ((host->flags & SDHCI_NEEDS_RETUNING) &&

		    !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) {

			/* eMMC uses cmd21 while sd and sdio use cmd19 */

			tuning_opcode = mmc->card->type == MMC_TYPE_MMC ?

			if (mmc->card) {

				/* eMMC uses cmd21 but sd and sdio use cmd19 */

				tuning_opcode =

					mmc->card->type == MMC_TYPE_MMC ?

					MMC_SEND_TUNING_BLOCK_HS200 :

					MMC_SEND_TUNING_BLOCK;

				spin_unlock_irqrestore(&host->lock, flags);
@@ -1326,6 +1328,7 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq) 
				/* Restore original mmc_request structure */

				host->mrq = mrq;

			}

		}



		if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))

			sdhci_send_command(host, mrq->sbc);