diff options
Diffstat (limited to 'bcm2835-fix-potential-null-pointer-dereferences.patch')
| -rw-r--r-- | bcm2835-fix-potential-null-pointer-dereferences.patch | 70 |
1 files changed, 70 insertions, 0 deletions
diff --git a/bcm2835-fix-potential-null-pointer-dereferences.patch b/bcm2835-fix-potential-null-pointer-dereferences.patch new file mode 100644 index 000000000..862e77fe8 --- /dev/null +++ b/bcm2835-fix-potential-null-pointer-dereferences.patch @@ -0,0 +1,70 @@ +From patchwork Thu May 25 17:04:55 2017 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [v2] mmc: bcm2835: fix potential null pointer dereferences +From: "Gustavo A. R. Silva" <garsilva@embeddedor.com> +X-Patchwork-Id: 9748761 +Message-Id: <20170525170455.GA6904@embeddedgus> +To: Stefan Wahren <stefan.wahren@i2se.com>, + Ulf Hansson <ulf.hansson@linaro.org>, + Florian Fainelli <f.fainelli@gmail.com>, + Ray Jui <rjui@broadcom.com>, Scott Branden <sbranden@broadcom.com>, + bcm-kernel-feedback-list@broadcom.com, Eric Anholt <eric@anholt.net> +Cc: "Gustavo A. R. Silva" <garsilva@embeddedor.com>, + linux-mmc@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, + linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org +Date: Thu, 25 May 2017 12:04:55 -0500 + +Null check at line 1165: if (mrq->cmd), implies that mrq->cmd might +be NULL. +Add null checks before dereferencing pointer mrq->cmd in order to avoid +any potential NULL pointer dereference. + +Addresses-Coverity-ID: 1408740 +Tested-by: Stefan Wahren <stefan.wahren@i2se.com> +Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> +--- +Changes in v2: + Change subject to make it clear the patch is bcm2835 related. + + drivers/mmc/host/bcm2835.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c +index 1f343a4..abba9a2 100644 +--- a/drivers/mmc/host/bcm2835.c ++++ b/drivers/mmc/host/bcm2835.c +@@ -1172,7 +1172,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) + if (mrq->data && !is_power_of_2(mrq->data->blksz)) { + dev_err(dev, "unsupported block size (%d bytes)\n", + mrq->data->blksz); +- mrq->cmd->error = -EINVAL; ++ ++ if (mrq->cmd) ++ mrq->cmd->error = -EINVAL; ++ + mmc_request_done(mmc, mrq); + return; + } +@@ -1194,7 +1197,10 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) + readl(host->ioaddr + SDCMD) & SDCMD_CMD_MASK, + edm); + bcm2835_dumpregs(host); +- mrq->cmd->error = -EILSEQ; ++ ++ if (mrq->cmd) ++ mrq->cmd->error = -EILSEQ; ++ + bcm2835_finish_request(host); + mutex_unlock(&host->mutex); + return; +@@ -1207,7 +1213,7 @@ static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq) + if (!host->use_busy) + bcm2835_finish_command(host); + } +- } else if (bcm2835_send_command(host, mrq->cmd)) { ++ } else if (mrq->cmd && bcm2835_send_command(host, mrq->cmd)) { + if (host->data && host->dma_desc) { + /* DMA transfer starts now, PIO starts after irq */ + bcm2835_start_dma(host); |