aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorChris Ball <cjb@laptop.org>2012-11-05 14:29:49 -0500
committerChris Ball <cjb@laptop.org>2012-11-07 15:02:05 -0500
commit14efd957209461bbdf285bf0d67e931955d04a4c (patch)
treee4e057308b28671aece200cde1516210f17af611 /drivers
parent657d59823c095e8f03e2744d765f53700331ff8f (diff)
mmc: sdhci: fix NULL dereference in sdhci_request() tuning
Commit 473b095a72a9 ("mmc: sdhci: fix incorrect command used in tuning") introduced a NULL dereference at resume-time if an SD 3.0 host controller raises the SDHCI_NEEDS_TUNING flag while no card is inserted. Seen on an OLPC XO-4 with sdhci-pxav3, but presumably affects other controllers too. Signed-off-by: Chris Ball <cjb@laptop.org> Cc: stable <stable@vger.kernel.org> [3.3+]
Diffstat (limited to 'drivers')
-rw-r--r--drivers/mmc/host/sdhci.c23
1 files changed, 13 insertions, 10 deletions
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 949e18c7c05d..c7851c0aabce 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1315,16 +1315,19 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
1315 */ 1315 */
1316 if ((host->flags & SDHCI_NEEDS_RETUNING) && 1316 if ((host->flags & SDHCI_NEEDS_RETUNING) &&
1317 !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) { 1317 !(present_state & (SDHCI_DOING_WRITE | SDHCI_DOING_READ))) {
1318 /* eMMC uses cmd21 while sd and sdio use cmd19 */ 1318 if (mmc->card) {
1319 tuning_opcode = mmc->card->type == MMC_TYPE_MMC ? 1319 /* eMMC uses cmd21 but sd and sdio use cmd19 */
1320 MMC_SEND_TUNING_BLOCK_HS200 : 1320 tuning_opcode =
1321 MMC_SEND_TUNING_BLOCK; 1321 mmc->card->type == MMC_TYPE_MMC ?
1322 spin_unlock_irqrestore(&host->lock, flags); 1322 MMC_SEND_TUNING_BLOCK_HS200 :
1323 sdhci_execute_tuning(mmc, tuning_opcode); 1323 MMC_SEND_TUNING_BLOCK;
1324 spin_lock_irqsave(&host->lock, flags); 1324 spin_unlock_irqrestore(&host->lock, flags);
1325 1325 sdhci_execute_tuning(mmc, tuning_opcode);
1326 /* Restore original mmc_request structure */ 1326 spin_lock_irqsave(&host->lock, flags);
1327 host->mrq = mrq; 1327
1328 /* Restore original mmc_request structure */
1329 host->mrq = mrq;
1330 }
1328 } 1331 }
1329 1332
1330 if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23)) 1333 if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))