mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish

It seems that under certain circumstances that the sdhci_tasklet_finish() call can be entered with mrq->cmd set to NULL, causing the system to crash with a NULL pointer de-reference. Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at sdhci_tasklet_finish+0x34/0xe8 LR is at sdhci_tasklet_finish+0x24/0xe8 Seen on S3C6410 system. Signed-off-by: Ben Dooks <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: <[email protected]> Signed-off-by: Chris Ball <[email protected]>
mgowda · Apr 27, 2011 · b7b4d34 · b7b4d34
1 parent c919c2a
commit b7b4d34
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
@@ -1345,7 +1345,7 @@ static void sdhci_tasklet_finish(unsigned long param)
 	 * upon error conditions.
 	 */
 	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
-		(mrq->cmd->error ||
+	    ((mrq->cmd && mrq->cmd->error) ||
 		 (mrq->data && (mrq->data->error ||
 		  (mrq->data->stop && mrq->data->stop->error))) ||
 		   (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {