Commit c00a231b authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Ulf Hansson

mmc: bcm2835: fix potential null pointer dereferences

Null check at line 1165: if (mrq->cmd), implies that mrq->cmd might
be NULL.
Add null checks before dereferencing pointer mrq->cmd in order to avoid
any potential NULL pointer dereference.

Addresses-Coverity-ID: 1408740
Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
parent d63c2bf4
......@@ -1172,7 +1172,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
if (mrq->data && !is_power_of_2(mrq->data->blksz)) {
dev_err(dev, "unsupported block size (%d bytes)\n",
mrq->data->blksz);
if (mrq->cmd)
mrq->cmd->error = -EINVAL;
mmc_request_done(mmc, mrq);
return;
}
......@@ -1194,7 +1197,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
readl(host->ioaddr + SDCMD) & SDCMD_CMD_MASK,
edm);
bcm2835_dumpregs(host);
if (mrq->cmd)
mrq->cmd->error = -EILSEQ;
bcm2835_finish_request(host);
mutex_unlock(&host->mutex);
return;
......@@ -1207,7 +1213,7 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
if (!host->use_busy)
bcm2835_finish_command(host);
}
} else if (bcm2835_send_command(host, mrq->cmd)) {
} else if (mrq->cmd && bcm2835_send_command(host, mrq->cmd)) {
if (host->data && host->dma_desc) {
/* DMA transfer starts now, PIO starts after irq */
bcm2835_start_dma(host);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment