mmc: sdhci: fix NULL dereference in sdhci_request() tuning (14efd957) · Commits · 戴 / test

Commit ("mmc: sdhci: fix incorrect command used in tuning") introduced a NULL dereference at resume-time if an SD 3.0 host controller raises the SDHCI_NEEDS_TUNING flag while no card is inserted. Seen on an OLPC XO-4 with sdhci-pxav3, but presumably affects other controllers too. Signed-off-by:

Chris Ball <cjb@laptop.org> Cc: stable <stable@vger.kernel.org> [3.3+]

drivers/mmc/host/sdhci.c

+13 −10

Original line number	Diff line number	Diff line
		@@ -1315,8 +1315,10 @@ static void sdhci_request(struct mmc_host mmc, struct mmc_request mrq)
		*/
		if ((host->flags & SDHCI_NEEDS_RETUNING) &&
		!(present_state & (SDHCI_DOING_WRITE \| SDHCI_DOING_READ))) {
		/* eMMC uses cmd21 while sd and sdio use cmd19 */
		tuning_opcode = mmc->card->type == MMC_TYPE_MMC ?
		if (mmc->card) {
		/* eMMC uses cmd21 but sd and sdio use cmd19 */
		tuning_opcode =
		mmc->card->type == MMC_TYPE_MMC ?
		MMC_SEND_TUNING_BLOCK_HS200 :
		MMC_SEND_TUNING_BLOCK;
		spin_unlock_irqrestore(&host->lock, flags);
		@@ -1326,6 +1328,7 @@ static void sdhci_request(struct mmc_host mmc, struct mmc_request mrq)
		/* Restore original mmc_request structure */
		host->mrq = mrq;
		}
		}

		if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
		sdhci_send_command(host, mrq->sbc);

Admin message