evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mmc: block: check for NULL pointer before dereferencing

Browse source 
mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
[merez@codeaurora.org: fix conflicts due to removal of BKOPS statistics]
Signed-off-by: Maya Erez <merez@codeaurora.org>
[subhashj@codeaurora.org: fixed trivial merge conflicts]
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
This commit is contained in:
Asutosh Das 2014-12-09 10:15:53 +02:00 • committed by Subhash Jadavani
parent e357ffba06
commit 2f6c967231
1 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
drivers/mmc/card/block.c
View file

@ -211,9 +211,13 @@ static ssize_t power_ro_lock_show(struct device *dev,
{
int ret;
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
struct mmc_card *card = md->queue.card;
struct mmc_card *card;
int locked = 0;
if (!md)
return -EINVAL;
card = md->queue.card;
if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PERM_WP_EN)
locked = 2;
else if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_EN)
@ -241,6 +245,8 @@ static ssize_t power_ro_lock_store(struct device *dev,
return count;
md = mmc_blk_get(dev_to_disk(dev));
if (!md)
return -EINVAL;
card = md->queue.card;
mmc_get_card(card);
@ -278,6 +284,9 @@ static ssize_t force_ro_show(struct device *dev, struct device_attribute *attr,
int ret;
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
if (!md)
return -EINVAL;
ret = snprintf(buf, PAGE_SIZE, "%d\n",
get_disk_ro(dev_to_disk(dev)) ^
md->read_only);
@ -292,6 +301,10 @@ static ssize_t force_ro_store(struct device *dev, struct device_attribute *attr,
char *end;
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
unsigned long set = simple_strtoul(buf, &end, 0);
if (!md)
return -EINVAL;
if (end == buf) {
ret = -EINVAL;
goto out;
@ -312,6 +325,8 @@ num_wr_reqs_to_start_packing_show(struct device *dev,
int num_wr_reqs_to_start_packing;
int ret;
if (!md)
return -EINVAL;
num_wr_reqs_to_start_packing = md->queue.num_wr_reqs_to_start_packing;
ret = snprintf(buf, PAGE_SIZE, "%d\n", num_wr_reqs_to_start_packing);
@ -327,9 +342,13 @@ num_wr_reqs_to_start_packing_store(struct device *dev,
{
int value;
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
struct mmc_card *card = md->queue.card;
struct mmc_card *card;
int ret = count;
if (!md)
return -EINVAL;
card = md->queue.card;
if (!card) {
ret = -EINVAL;
goto exit;
@ -363,6 +382,8 @@ no_pack_for_random_show(struct device *dev,
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
int ret;
if (!md)
return -EINVAL;
ret = snprintf(buf, PAGE_SIZE, "%d\n", md->queue.no_pack_for_random);
mmc_blk_put(md);
@ -376,9 +397,13 @@ no_pack_for_random_store(struct device *dev,
{
int value;
struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
struct mmc_card *card = md->queue.card;
struct mmc_card *card;
int ret = count;
if (!md)
return -EINVAL;
card = md->queue.card;
if (!card) {
ret = -EINVAL;
goto exit;
@ -735,7 +760,7 @@ static int mmc_blk_ioctl_rpmb_cmd(struct block_device *bdev,
/* make sure this is a rpmb partition */
if ((!md) || (!(md->area_type & MMC_BLK_DATA_AREA_RPMB))) {
err = -EINVAL;
goto cmd_done;
return err;
}
idata = mmc_blk_ioctl_rpmb_copy_from_user(ic_ptr);