All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
@ 2012-10-16  8:43 ` James Hogan
  0 siblings, 0 replies; 13+ messages in thread
From: James Hogan @ 2012-10-16  8:43 UTC (permalink / raw)
  To: Chris Ball, Will Newton, Thomas Abraham
  Cc: Jaehoon Chung, Seungwon Jeon, linux-mmc, linux-kernel, James Hogan

Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
support for implementation specific callbacks") merged in v3.7-rc1.

The above commit introduced multiple NULL pointer dereferences when
the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
NULL, and that's only checked against NULL in 1 out of the 7 cases where
it is dereferenced.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
---
 drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
 drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c960ca7..e595721 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
 	if (!host->regs)
 		return -ENOMEM;
 
-	if (host->drv_data->init) {
-		ret = host->drv_data->init(host);
+	if (drv_data && drv_data->init) {
+		ret = drv_data->init(host);
 		if (ret)
 			return ret;
 	}
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c2828f3..0dc6e33 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 {
 	struct mmc_data	*data;
 	struct dw_mci_slot *slot = mmc_priv(mmc);
+	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 cmdr;
 	cmd->error = -EINPROGRESS;
 
@@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 			cmdr |= SDMMC_CMD_DAT_WR;
 	}
 
-	if (slot->host->drv_data->prepare_command)
-		slot->host->drv_data->prepare_command(slot->host, &cmdr);
+	if (drv_data && drv_data->prepare_command)
+		drv_data->prepare_command(slot->host, &cmdr);
 
 	return cmdr;
 }
@@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
 static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
 	struct dw_mci_slot *slot = mmc_priv(mmc);
+	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 regs;
 
 	/* set default 1 bit mode */
@@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 		slot->clock = ios->clock;
 	}
 
-	if (slot->host->drv_data->set_ios)
-		slot->host->drv_data->set_ios(slot->host, ios);
+	if (drv_data && drv_data->set_ios)
+		drv_data->set_ios(slot->host, ios);
 
 	switch (ios->power_mode) {
 	case MMC_POWER_UP:
@@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 {
 	struct mmc_host *mmc;
 	struct dw_mci_slot *slot;
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int ctrl_id, ret;
 	u8 bus_width;
 
@@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 	} else {
 		ctrl_id = to_platform_device(host->dev)->id;
 	}
-	if (host->drv_data && host->drv_data->caps)
-		mmc->caps |= host->drv_data->caps[ctrl_id];
+	if (drv_data && drv_data->caps)
+		mmc->caps |= drv_data->caps[ctrl_id];
 
 	if (host->pdata->caps2)
 		mmc->caps2 = host->pdata->caps2;
@@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 	else
 		bus_width = 1;
 
-	if (host->drv_data->setup_bus) {
+	if (drv_data && drv_data->setup_bus) {
 		struct device_node *slot_np;
 		slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
-		ret = host->drv_data->setup_bus(host, slot_np, bus_width);
+		ret = drv_data->setup_bus(host, slot_np, bus_width);
 		if (ret)
 			goto err_setup_bus;
 	}
@@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 	struct dw_mci_board *pdata;
 	struct device *dev = host->dev;
 	struct device_node *np = dev->of_node;
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int idx, ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
@@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 
 	of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
 
-	if (host->drv_data->parse_dt) {
-		ret = host->drv_data->parse_dt(host);
+	if (drv_data && drv_data->parse_dt) {
+		ret = drv_data->parse_dt(host);
 		if (ret)
 			return ERR_PTR(ret);
 	}
@@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 
 int dw_mci_probe(struct dw_mci *host)
 {
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int width, i, ret = 0;
 	u32 fifo_size;
 	int init_slots = 0;
@@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
 	else
 		host->bus_hz = clk_get_rate(host->ciu_clk);
 
-	if (host->drv_data->setup_clock) {
-		ret = host->drv_data->setup_clock(host);
+	if (drv_data && drv_data->setup_clock) {
+		ret = drv_data->setup_clock(host);
 		if (ret) {
 			dev_err(host->dev,
 				"implementation specific clock setup failed\n");
-- 
1.7.7.6



^ permalink raw reply related	[flat|nested] 13+ messages in thread
* [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
@ 2012-10-16  8:43 ` James Hogan
  0 siblings, 0 replies; 13+ messages in thread
From: James Hogan @ 2012-10-16  8:43 UTC (permalink / raw)
  To: Chris Ball, Will Newton, Thomas Abraham
  Cc: Jaehoon Chung, Seungwon Jeon, linux-mmc, linux-kernel, James Hogan

Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
support for implementation specific callbacks") merged in v3.7-rc1.

The above commit introduced multiple NULL pointer dereferences when
the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
NULL, and that's only checked against NULL in 1 out of the 7 cases where
it is dereferenced.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
---
 drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
 drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index c960ca7..e595721 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
 	if (!host->regs)
 		return -ENOMEM;
 
-	if (host->drv_data->init) {
-		ret = host->drv_data->init(host);
+	if (drv_data && drv_data->init) {
+		ret = drv_data->init(host);
 		if (ret)
 			return ret;
 	}
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c2828f3..0dc6e33 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 {
 	struct mmc_data	*data;
 	struct dw_mci_slot *slot = mmc_priv(mmc);
+	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 cmdr;
 	cmd->error = -EINPROGRESS;
 
@@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 			cmdr |= SDMMC_CMD_DAT_WR;
 	}
 
-	if (slot->host->drv_data->prepare_command)
-		slot->host->drv_data->prepare_command(slot->host, &cmdr);
+	if (drv_data && drv_data->prepare_command)
+		drv_data->prepare_command(slot->host, &cmdr);
 
 	return cmdr;
 }
@@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
 static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
 	struct dw_mci_slot *slot = mmc_priv(mmc);
+	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 regs;
 
 	/* set default 1 bit mode */
@@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 		slot->clock = ios->clock;
 	}
 
-	if (slot->host->drv_data->set_ios)
-		slot->host->drv_data->set_ios(slot->host, ios);
+	if (drv_data && drv_data->set_ios)
+		drv_data->set_ios(slot->host, ios);
 
 	switch (ios->power_mode) {
 	case MMC_POWER_UP:
@@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 {
 	struct mmc_host *mmc;
 	struct dw_mci_slot *slot;
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int ctrl_id, ret;
 	u8 bus_width;
 
@@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 	} else {
 		ctrl_id = to_platform_device(host->dev)->id;
 	}
-	if (host->drv_data && host->drv_data->caps)
-		mmc->caps |= host->drv_data->caps[ctrl_id];
+	if (drv_data && drv_data->caps)
+		mmc->caps |= drv_data->caps[ctrl_id];
 
 	if (host->pdata->caps2)
 		mmc->caps2 = host->pdata->caps2;
@@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 	else
 		bus_width = 1;
 
-	if (host->drv_data->setup_bus) {
+	if (drv_data && drv_data->setup_bus) {
 		struct device_node *slot_np;
 		slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
-		ret = host->drv_data->setup_bus(host, slot_np, bus_width);
+		ret = drv_data->setup_bus(host, slot_np, bus_width);
 		if (ret)
 			goto err_setup_bus;
 	}
@@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 	struct dw_mci_board *pdata;
 	struct device *dev = host->dev;
 	struct device_node *np = dev->of_node;
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int idx, ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
@@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 
 	of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
 
-	if (host->drv_data->parse_dt) {
-		ret = host->drv_data->parse_dt(host);
+	if (drv_data && drv_data->parse_dt) {
+		ret = drv_data->parse_dt(host);
 		if (ret)
 			return ERR_PTR(ret);
 	}
@@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 
 int dw_mci_probe(struct dw_mci *host)
 {
+	struct dw_mci_drv_data *drv_data = host->drv_data;
 	int width, i, ret = 0;
 	u32 fifo_size;
 	int init_slots = 0;
@@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
 	else
 		host->bus_hz = clk_get_rate(host->ciu_clk);
 
-	if (host->drv_data->setup_clock) {
-		ret = host->drv_data->setup_clock(host);
+	if (drv_data && drv_data->setup_clock) {
+		ret = drv_data->setup_clock(host);
 		if (ret) {
 			dev_err(host->dev,
 				"implementation specific clock setup failed\n");
-- 
1.7.7.6

^ permalink raw reply related	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-16  8:43 ` James Hogan
  (?)
@ 2012-10-16 10:49 ` Thomas Abraham
  -1 siblings, 0 replies; 13+ messages in thread
From: Thomas Abraham @ 2012-10-16 10:49 UTC (permalink / raw)
  To: James Hogan
  Cc: Chris Ball, Will Newton, Jaehoon Chung, Seungwon Jeon, linux-mmc,
	linux-kernel

On 16 October 2012 14:13, James Hogan <james.hogan@imgtec.com> wrote:
> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
> support for implementation specific callbacks") merged in v3.7-rc1.
>
> The above commit introduced multiple NULL pointer dereferences when
> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
> NULL, and that's only checked against NULL in 1 out of the 7 cases where
> it is dereferenced.
>
> Signed-off-by: James Hogan <james.hogan@imgtec.com>
> ---
>  drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
>  drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
>  2 files changed, 19 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
> index c960ca7..e595721 100644
> --- a/drivers/mmc/host/dw_mmc-pltfm.c
> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
> @@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
>         if (!host->regs)
>                 return -ENOMEM;
>
> -       if (host->drv_data->init) {
> -               ret = host->drv_data->init(host);
> +       if (drv_data && drv_data->init) {
> +               ret = drv_data->init(host);
>                 if (ret)
>                         return ret;
>         }
> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
> index c2828f3..0dc6e33 100644
> --- a/drivers/mmc/host/dw_mmc.c
> +++ b/drivers/mmc/host/dw_mmc.c
> @@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>  {
>         struct mmc_data *data;
>         struct dw_mci_slot *slot = mmc_priv(mmc);
> +       struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>         u32 cmdr;
>         cmd->error = -EINPROGRESS;
>
> @@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>                         cmdr |= SDMMC_CMD_DAT_WR;
>         }
>
> -       if (slot->host->drv_data->prepare_command)
> -               slot->host->drv_data->prepare_command(slot->host, &cmdr);
> +       if (drv_data && drv_data->prepare_command)
> +               drv_data->prepare_command(slot->host, &cmdr);
>
>         return cmdr;
>  }
> @@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
>  static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>  {
>         struct dw_mci_slot *slot = mmc_priv(mmc);
> +       struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>         u32 regs;
>
>         /* set default 1 bit mode */
> @@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>                 slot->clock = ios->clock;
>         }
>
> -       if (slot->host->drv_data->set_ios)
> -               slot->host->drv_data->set_ios(slot->host, ios);
> +       if (drv_data && drv_data->set_ios)
> +               drv_data->set_ios(slot->host, ios);
>
>         switch (ios->power_mode) {
>         case MMC_POWER_UP:
> @@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>  {
>         struct mmc_host *mmc;
>         struct dw_mci_slot *slot;
> +       struct dw_mci_drv_data *drv_data = host->drv_data;
>         int ctrl_id, ret;
>         u8 bus_width;
>
> @@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>         } else {
>                 ctrl_id = to_platform_device(host->dev)->id;
>         }
> -       if (host->drv_data && host->drv_data->caps)
> -               mmc->caps |= host->drv_data->caps[ctrl_id];
> +       if (drv_data && drv_data->caps)
> +               mmc->caps |= drv_data->caps[ctrl_id];
>
>         if (host->pdata->caps2)
>                 mmc->caps2 = host->pdata->caps2;
> @@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>         else
>                 bus_width = 1;
>
> -       if (host->drv_data->setup_bus) {
> +       if (drv_data && drv_data->setup_bus) {
>                 struct device_node *slot_np;
>                 slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
> -               ret = host->drv_data->setup_bus(host, slot_np, bus_width);
> +               ret = drv_data->setup_bus(host, slot_np, bus_width);
>                 if (ret)
>                         goto err_setup_bus;
>         }
> @@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>         struct dw_mci_board *pdata;
>         struct device *dev = host->dev;
>         struct device_node *np = dev->of_node;
> +       struct dw_mci_drv_data *drv_data = host->drv_data;
>         int idx, ret;
>
>         pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
> @@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>
>         of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
>
> -       if (host->drv_data->parse_dt) {
> -               ret = host->drv_data->parse_dt(host);
> +       if (drv_data && drv_data->parse_dt) {
> +               ret = drv_data->parse_dt(host);
>                 if (ret)
>                         return ERR_PTR(ret);
>         }
> @@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>
>  int dw_mci_probe(struct dw_mci *host)
>  {
> +       struct dw_mci_drv_data *drv_data = host->drv_data;
>         int width, i, ret = 0;
>         u32 fifo_size;
>         int init_slots = 0;
> @@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
>         else
>                 host->bus_hz = clk_get_rate(host->ciu_clk);
>
> -       if (host->drv_data->setup_clock) {
> -               ret = host->drv_data->setup_clock(host);
> +       if (drv_data && drv_data->setup_clock) {
> +               ret = drv_data->setup_clock(host);
>                 if (ret) {
>                         dev_err(host->dev,
>                                 "implementation specific clock setup failed\n");
> --
> 1.7.7.6
>
>

Acked-by: Thomas Abraham <thomas.abraham@linaro.org>

^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-16  8:43 ` James Hogan
  (?)
  (?)
@ 2012-10-16 10:54 ` Seungwon Jeon
  -1 siblings, 0 replies; 13+ messages in thread
From: Seungwon Jeon @ 2012-10-16 10:54 UTC (permalink / raw)
  To: 'James Hogan', 'Chris Ball',
	'Will Newton', 'Thomas Abraham'
  Cc: 'Jaehoon Chung', linux-mmc, linux-kernel

On Tuesday, October 16, James Hogan <james.hogan@imgtec.com>
> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
> support for implementation specific callbacks") merged in v3.7-rc1.
> 
> The above commit introduced multiple NULL pointer dereferences when
> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
> NULL, and that's only checked against NULL in 1 out of the 7 cases where
> it is dereferenced.
> 
> Signed-off-by: James Hogan <james.hogan@imgtec.com>

Acked-by: Seungwon Jeon <tgih.jun@samsung.com>

Looks good to me.
Thanks.

Seungwon Jeon


^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-16  8:43 ` James Hogan
                   ` (2 preceding siblings ...)
  (?)
@ 2012-10-17  2:06 ` Jaehoon Chung
  2012-10-17  9:11   ` Will Newton
  -1 siblings, 1 reply; 13+ messages in thread
From: Jaehoon Chung @ 2012-10-17  2:06 UTC (permalink / raw)
  To: James Hogan
  Cc: Chris Ball, Will Newton, Thomas Abraham, Jaehoon Chung,
	Seungwon Jeon, linux-mmc, linux-kernel

Looks good to me.

Acked-by: Jaehoon Chung <jh80.chung@samsung.com>

On 10/16/2012 05:43 PM, James Hogan wrote:
> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
> support for implementation specific callbacks") merged in v3.7-rc1.
> 
> The above commit introduced multiple NULL pointer dereferences when
> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
> NULL, and that's only checked against NULL in 1 out of the 7 cases where
> it is dereferenced.
> 
> Signed-off-by: James Hogan <james.hogan@imgtec.com>
> ---
>  drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
>  drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
>  2 files changed, 19 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
> index c960ca7..e595721 100644
> --- a/drivers/mmc/host/dw_mmc-pltfm.c
> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
> @@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
>  	if (!host->regs)
>  		return -ENOMEM;
>  
> -	if (host->drv_data->init) {
> -		ret = host->drv_data->init(host);
> +	if (drv_data && drv_data->init) {
> +		ret = drv_data->init(host);
>  		if (ret)
>  			return ret;
>  	}
> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
> index c2828f3..0dc6e33 100644
> --- a/drivers/mmc/host/dw_mmc.c
> +++ b/drivers/mmc/host/dw_mmc.c
> @@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>  {
>  	struct mmc_data	*data;
>  	struct dw_mci_slot *slot = mmc_priv(mmc);
> +	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>  	u32 cmdr;
>  	cmd->error = -EINPROGRESS;
>  
> @@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>  			cmdr |= SDMMC_CMD_DAT_WR;
>  	}
>  
> -	if (slot->host->drv_data->prepare_command)
> -		slot->host->drv_data->prepare_command(slot->host, &cmdr);
> +	if (drv_data && drv_data->prepare_command)
> +		drv_data->prepare_command(slot->host, &cmdr);
>  
>  	return cmdr;
>  }
> @@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
>  static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>  {
>  	struct dw_mci_slot *slot = mmc_priv(mmc);
> +	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>  	u32 regs;
>  
>  	/* set default 1 bit mode */
> @@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>  		slot->clock = ios->clock;
>  	}
>  
> -	if (slot->host->drv_data->set_ios)
> -		slot->host->drv_data->set_ios(slot->host, ios);
> +	if (drv_data && drv_data->set_ios)
> +		drv_data->set_ios(slot->host, ios);
>  
>  	switch (ios->power_mode) {
>  	case MMC_POWER_UP:
> @@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>  {
>  	struct mmc_host *mmc;
>  	struct dw_mci_slot *slot;
> +	struct dw_mci_drv_data *drv_data = host->drv_data;
>  	int ctrl_id, ret;
>  	u8 bus_width;
>  
> @@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>  	} else {
>  		ctrl_id = to_platform_device(host->dev)->id;
>  	}
> -	if (host->drv_data && host->drv_data->caps)
> -		mmc->caps |= host->drv_data->caps[ctrl_id];
> +	if (drv_data && drv_data->caps)
> +		mmc->caps |= drv_data->caps[ctrl_id];
>  
>  	if (host->pdata->caps2)
>  		mmc->caps2 = host->pdata->caps2;
> @@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>  	else
>  		bus_width = 1;
>  
> -	if (host->drv_data->setup_bus) {
> +	if (drv_data && drv_data->setup_bus) {
>  		struct device_node *slot_np;
>  		slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
> -		ret = host->drv_data->setup_bus(host, slot_np, bus_width);
> +		ret = drv_data->setup_bus(host, slot_np, bus_width);
>  		if (ret)
>  			goto err_setup_bus;
>  	}
> @@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>  	struct dw_mci_board *pdata;
>  	struct device *dev = host->dev;
>  	struct device_node *np = dev->of_node;
> +	struct dw_mci_drv_data *drv_data = host->drv_data;
>  	int idx, ret;
>  
>  	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
> @@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>  
>  	of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
>  
> -	if (host->drv_data->parse_dt) {
> -		ret = host->drv_data->parse_dt(host);
> +	if (drv_data && drv_data->parse_dt) {
> +		ret = drv_data->parse_dt(host);
>  		if (ret)
>  			return ERR_PTR(ret);
>  	}
> @@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>  
>  int dw_mci_probe(struct dw_mci *host)
>  {
> +	struct dw_mci_drv_data *drv_data = host->drv_data;
>  	int width, i, ret = 0;
>  	u32 fifo_size;
>  	int init_slots = 0;
> @@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
>  	else
>  		host->bus_hz = clk_get_rate(host->ciu_clk);
>  
> -	if (host->drv_data->setup_clock) {
> -		ret = host->drv_data->setup_clock(host);
> +	if (drv_data && drv_data->setup_clock) {
> +		ret = drv_data->setup_clock(host);
>  		if (ret) {
>  			dev_err(host->dev,
>  				"implementation specific clock setup failed\n");
> 


^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-17  2:06 ` Jaehoon Chung
@ 2012-10-17  9:11   ` Will Newton
  2012-10-29  9:34       ` James Hogan
  0 siblings, 1 reply; 13+ messages in thread
From: Will Newton @ 2012-10-17  9:11 UTC (permalink / raw)
  To: Jaehoon Chung
  Cc: James Hogan, Chris Ball, Thomas Abraham, Seungwon Jeon,
	linux-mmc, linux-kernel

Looks good to me too.

Acked-by: Will Newton <will.newton@imgtec.com>

On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
> Looks good to me.
>
> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
>
> On 10/16/2012 05:43 PM, James Hogan wrote:
>> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
>> support for implementation specific callbacks") merged in v3.7-rc1.
>>
>> The above commit introduced multiple NULL pointer dereferences when
>> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
>> NULL, and that's only checked against NULL in 1 out of the 7 cases where
>> it is dereferenced.
>>
>> Signed-off-by: James Hogan <james.hogan@imgtec.com>
>> ---
>>  drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
>>  drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
>>  2 files changed, 19 insertions(+), 14 deletions(-)
>>
>> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
>> index c960ca7..e595721 100644
>> --- a/drivers/mmc/host/dw_mmc-pltfm.c
>> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
>> @@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
>>       if (!host->regs)
>>               return -ENOMEM;
>>
>> -     if (host->drv_data->init) {
>> -             ret = host->drv_data->init(host);
>> +     if (drv_data && drv_data->init) {
>> +             ret = drv_data->init(host);
>>               if (ret)
>>                       return ret;
>>       }
>> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
>> index c2828f3..0dc6e33 100644
>> --- a/drivers/mmc/host/dw_mmc.c
>> +++ b/drivers/mmc/host/dw_mmc.c
>> @@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>  {
>>       struct mmc_data *data;
>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>       u32 cmdr;
>>       cmd->error = -EINPROGRESS;
>>
>> @@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>                       cmdr |= SDMMC_CMD_DAT_WR;
>>       }
>>
>> -     if (slot->host->drv_data->prepare_command)
>> -             slot->host->drv_data->prepare_command(slot->host, &cmdr);
>> +     if (drv_data && drv_data->prepare_command)
>> +             drv_data->prepare_command(slot->host, &cmdr);
>>
>>       return cmdr;
>>  }
>> @@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
>>  static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>  {
>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>       u32 regs;
>>
>>       /* set default 1 bit mode */
>> @@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>               slot->clock = ios->clock;
>>       }
>>
>> -     if (slot->host->drv_data->set_ios)
>> -             slot->host->drv_data->set_ios(slot->host, ios);
>> +     if (drv_data && drv_data->set_ios)
>> +             drv_data->set_ios(slot->host, ios);
>>
>>       switch (ios->power_mode) {
>>       case MMC_POWER_UP:
>> @@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>  {
>>       struct mmc_host *mmc;
>>       struct dw_mci_slot *slot;
>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>       int ctrl_id, ret;
>>       u8 bus_width;
>>
>> @@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>       } else {
>>               ctrl_id = to_platform_device(host->dev)->id;
>>       }
>> -     if (host->drv_data && host->drv_data->caps)
>> -             mmc->caps |= host->drv_data->caps[ctrl_id];
>> +     if (drv_data && drv_data->caps)
>> +             mmc->caps |= drv_data->caps[ctrl_id];
>>
>>       if (host->pdata->caps2)
>>               mmc->caps2 = host->pdata->caps2;
>> @@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>       else
>>               bus_width = 1;
>>
>> -     if (host->drv_data->setup_bus) {
>> +     if (drv_data && drv_data->setup_bus) {
>>               struct device_node *slot_np;
>>               slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
>> -             ret = host->drv_data->setup_bus(host, slot_np, bus_width);
>> +             ret = drv_data->setup_bus(host, slot_np, bus_width);
>>               if (ret)
>>                       goto err_setup_bus;
>>       }
>> @@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>       struct dw_mci_board *pdata;
>>       struct device *dev = host->dev;
>>       struct device_node *np = dev->of_node;
>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>       int idx, ret;
>>
>>       pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
>> @@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>
>>       of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
>>
>> -     if (host->drv_data->parse_dt) {
>> -             ret = host->drv_data->parse_dt(host);
>> +     if (drv_data && drv_data->parse_dt) {
>> +             ret = drv_data->parse_dt(host);
>>               if (ret)
>>                       return ERR_PTR(ret);
>>       }
>> @@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>
>>  int dw_mci_probe(struct dw_mci *host)
>>  {
>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>       int width, i, ret = 0;
>>       u32 fifo_size;
>>       int init_slots = 0;
>> @@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
>>       else
>>               host->bus_hz = clk_get_rate(host->ciu_clk);
>>
>> -     if (host->drv_data->setup_clock) {
>> -             ret = host->drv_data->setup_clock(host);
>> +     if (drv_data && drv_data->setup_clock) {
>> +             ret = drv_data->setup_clock(host);
>>               if (ret) {
>>                       dev_err(host->dev,
>>                               "implementation specific clock setup failed\n");
>>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-17  9:11   ` Will Newton
@ 2012-10-29  9:34       ` James Hogan
  0 siblings, 0 replies; 13+ messages in thread
From: James Hogan @ 2012-10-29  9:34 UTC (permalink / raw)
  To: Chris Ball
  Cc: Will Newton, Jaehoon Chung, Thomas Abraham, Seungwon Jeon,
	linux-mmc, linux-kernel

On 17/10/12 10:11, Will Newton wrote:
> Looks good to me too.
> 
> Acked-by: Will Newton <will.newton@imgtec.com>
> 
> On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
>> Looks good to me.
>>
>> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>

Thanks for the acks Thomas, Seungwon, Jaehoon and Will.

Chris: Any chance of queueing this patch for v3.7?

Thanks
James

>>
>> On 10/16/2012 05:43 PM, James Hogan wrote:
>>> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
>>> support for implementation specific callbacks") merged in v3.7-rc1.
>>>
>>> The above commit introduced multiple NULL pointer dereferences when
>>> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
>>> NULL, and that's only checked against NULL in 1 out of the 7 cases where
>>> it is dereferenced.
>>>
>>> Signed-off-by: James Hogan <james.hogan@imgtec.com>
>>> ---
>>>  drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
>>>  drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
>>>  2 files changed, 19 insertions(+), 14 deletions(-)
>>>
>>> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
>>> index c960ca7..e595721 100644
>>> --- a/drivers/mmc/host/dw_mmc-pltfm.c
>>> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
>>> @@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
>>>       if (!host->regs)
>>>               return -ENOMEM;
>>>
>>> -     if (host->drv_data->init) {
>>> -             ret = host->drv_data->init(host);
>>> +     if (drv_data && drv_data->init) {
>>> +             ret = drv_data->init(host);
>>>               if (ret)
>>>                       return ret;
>>>       }
>>> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
>>> index c2828f3..0dc6e33 100644
>>> --- a/drivers/mmc/host/dw_mmc.c
>>> +++ b/drivers/mmc/host/dw_mmc.c
>>> @@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>>  {
>>>       struct mmc_data *data;
>>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>>       u32 cmdr;
>>>       cmd->error = -EINPROGRESS;
>>>
>>> @@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>>                       cmdr |= SDMMC_CMD_DAT_WR;
>>>       }
>>>
>>> -     if (slot->host->drv_data->prepare_command)
>>> -             slot->host->drv_data->prepare_command(slot->host, &cmdr);
>>> +     if (drv_data && drv_data->prepare_command)
>>> +             drv_data->prepare_command(slot->host, &cmdr);
>>>
>>>       return cmdr;
>>>  }
>>> @@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
>>>  static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>>  {
>>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>>       u32 regs;
>>>
>>>       /* set default 1 bit mode */
>>> @@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>>               slot->clock = ios->clock;
>>>       }
>>>
>>> -     if (slot->host->drv_data->set_ios)
>>> -             slot->host->drv_data->set_ios(slot->host, ios);
>>> +     if (drv_data && drv_data->set_ios)
>>> +             drv_data->set_ios(slot->host, ios);
>>>
>>>       switch (ios->power_mode) {
>>>       case MMC_POWER_UP:
>>> @@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>  {
>>>       struct mmc_host *mmc;
>>>       struct dw_mci_slot *slot;
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int ctrl_id, ret;
>>>       u8 bus_width;
>>>
>>> @@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>       } else {
>>>               ctrl_id = to_platform_device(host->dev)->id;
>>>       }
>>> -     if (host->drv_data && host->drv_data->caps)
>>> -             mmc->caps |= host->drv_data->caps[ctrl_id];
>>> +     if (drv_data && drv_data->caps)
>>> +             mmc->caps |= drv_data->caps[ctrl_id];
>>>
>>>       if (host->pdata->caps2)
>>>               mmc->caps2 = host->pdata->caps2;
>>> @@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>       else
>>>               bus_width = 1;
>>>
>>> -     if (host->drv_data->setup_bus) {
>>> +     if (drv_data && drv_data->setup_bus) {
>>>               struct device_node *slot_np;
>>>               slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
>>> -             ret = host->drv_data->setup_bus(host, slot_np, bus_width);
>>> +             ret = drv_data->setup_bus(host, slot_np, bus_width);
>>>               if (ret)
>>>                       goto err_setup_bus;
>>>       }
>>> @@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>       struct dw_mci_board *pdata;
>>>       struct device *dev = host->dev;
>>>       struct device_node *np = dev->of_node;
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int idx, ret;
>>>
>>>       pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
>>> @@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>
>>>       of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
>>>
>>> -     if (host->drv_data->parse_dt) {
>>> -             ret = host->drv_data->parse_dt(host);
>>> +     if (drv_data && drv_data->parse_dt) {
>>> +             ret = drv_data->parse_dt(host);
>>>               if (ret)
>>>                       return ERR_PTR(ret);
>>>       }
>>> @@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>
>>>  int dw_mci_probe(struct dw_mci *host)
>>>  {
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int width, i, ret = 0;
>>>       u32 fifo_size;
>>>       int init_slots = 0;
>>> @@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
>>>       else
>>>               host->bus_hz = clk_get_rate(host->ciu_clk);
>>>
>>> -     if (host->drv_data->setup_clock) {
>>> -             ret = host->drv_data->setup_clock(host);
>>> +     if (drv_data && drv_data->setup_clock) {
>>> +             ret = drv_data->setup_clock(host);
>>>               if (ret) {
>>>                       dev_err(host->dev,
>>>                               "implementation specific clock setup failed\n");
>>>
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html


^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
@ 2012-10-29  9:34       ` James Hogan
  0 siblings, 0 replies; 13+ messages in thread
From: James Hogan @ 2012-10-29  9:34 UTC (permalink / raw)
  To: Chris Ball
  Cc: Will Newton, Jaehoon Chung, Thomas Abraham, Seungwon Jeon,
	linux-mmc, linux-kernel

On 17/10/12 10:11, Will Newton wrote:
> Looks good to me too.
> 
> Acked-by: Will Newton <will.newton@imgtec.com>
> 
> On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
>> Looks good to me.
>>
>> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>

Thanks for the acks Thomas, Seungwon, Jaehoon and Will.

Chris: Any chance of queueing this patch for v3.7?

Thanks
James

>>
>> On 10/16/2012 05:43 PM, James Hogan wrote:
>>> Commit 800d78bfccb3d38116abfda2a5b9c8afdbd5ea21 ("mmc: dw_mmc: add
>>> support for implementation specific callbacks") merged in v3.7-rc1.
>>>
>>> The above commit introduced multiple NULL pointer dereferences when
>>> the default dw_mci_pltfm_probe() is used, as it sets host->drv_data to
>>> NULL, and that's only checked against NULL in 1 out of the 7 cases where
>>> it is dereferenced.
>>>
>>> Signed-off-by: James Hogan <james.hogan@imgtec.com>
>>> ---
>>>  drivers/mmc/host/dw_mmc-pltfm.c |    4 ++--
>>>  drivers/mmc/host/dw_mmc.c       |   29 +++++++++++++++++------------
>>>  2 files changed, 19 insertions(+), 14 deletions(-)
>>>
>>> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
>>> index c960ca7..e595721 100644
>>> --- a/drivers/mmc/host/dw_mmc-pltfm.c
>>> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
>>> @@ -50,8 +50,8 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
>>>       if (!host->regs)
>>>               return -ENOMEM;
>>>
>>> -     if (host->drv_data->init) {
>>> -             ret = host->drv_data->init(host);
>>> +     if (drv_data && drv_data->init) {
>>> +             ret = drv_data->init(host);
>>>               if (ret)
>>>                       return ret;
>>>       }
>>> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
>>> index c2828f3..0dc6e33 100644
>>> --- a/drivers/mmc/host/dw_mmc.c
>>> +++ b/drivers/mmc/host/dw_mmc.c
>>> @@ -232,6 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>>  {
>>>       struct mmc_data *data;
>>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>>       u32 cmdr;
>>>       cmd->error = -EINPROGRESS;
>>>
>>> @@ -261,8 +262,8 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
>>>                       cmdr |= SDMMC_CMD_DAT_WR;
>>>       }
>>>
>>> -     if (slot->host->drv_data->prepare_command)
>>> -             slot->host->drv_data->prepare_command(slot->host, &cmdr);
>>> +     if (drv_data && drv_data->prepare_command)
>>> +             drv_data->prepare_command(slot->host, &cmdr);
>>>
>>>       return cmdr;
>>>  }
>>> @@ -772,6 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
>>>  static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>>  {
>>>       struct dw_mci_slot *slot = mmc_priv(mmc);
>>> +     struct dw_mci_drv_data *drv_data = slot->host->drv_data;
>>>       u32 regs;
>>>
>>>       /* set default 1 bit mode */
>>> @@ -807,8 +809,8 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
>>>               slot->clock = ios->clock;
>>>       }
>>>
>>> -     if (slot->host->drv_data->set_ios)
>>> -             slot->host->drv_data->set_ios(slot->host, ios);
>>> +     if (drv_data && drv_data->set_ios)
>>> +             drv_data->set_ios(slot->host, ios);
>>>
>>>       switch (ios->power_mode) {
>>>       case MMC_POWER_UP:
>>> @@ -1815,6 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>  {
>>>       struct mmc_host *mmc;
>>>       struct dw_mci_slot *slot;
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int ctrl_id, ret;
>>>       u8 bus_width;
>>>
>>> @@ -1854,8 +1857,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>       } else {
>>>               ctrl_id = to_platform_device(host->dev)->id;
>>>       }
>>> -     if (host->drv_data && host->drv_data->caps)
>>> -             mmc->caps |= host->drv_data->caps[ctrl_id];
>>> +     if (drv_data && drv_data->caps)
>>> +             mmc->caps |= drv_data->caps[ctrl_id];
>>>
>>>       if (host->pdata->caps2)
>>>               mmc->caps2 = host->pdata->caps2;
>>> @@ -1867,10 +1870,10 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
>>>       else
>>>               bus_width = 1;
>>>
>>> -     if (host->drv_data->setup_bus) {
>>> +     if (drv_data && drv_data->setup_bus) {
>>>               struct device_node *slot_np;
>>>               slot_np = dw_mci_of_find_slot_node(host->dev, slot->id);
>>> -             ret = host->drv_data->setup_bus(host, slot_np, bus_width);
>>> +             ret = drv_data->setup_bus(host, slot_np, bus_width);
>>>               if (ret)
>>>                       goto err_setup_bus;
>>>       }
>>> @@ -2035,6 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>       struct dw_mci_board *pdata;
>>>       struct device *dev = host->dev;
>>>       struct device_node *np = dev->of_node;
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int idx, ret;
>>>
>>>       pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
>>> @@ -2062,8 +2066,8 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>
>>>       of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
>>>
>>> -     if (host->drv_data->parse_dt) {
>>> -             ret = host->drv_data->parse_dt(host);
>>> +     if (drv_data && drv_data->parse_dt) {
>>> +             ret = drv_data->parse_dt(host);
>>>               if (ret)
>>>                       return ERR_PTR(ret);
>>>       }
>>> @@ -2080,6 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
>>>
>>>  int dw_mci_probe(struct dw_mci *host)
>>>  {
>>> +     struct dw_mci_drv_data *drv_data = host->drv_data;
>>>       int width, i, ret = 0;
>>>       u32 fifo_size;
>>>       int init_slots = 0;
>>> @@ -2127,8 +2132,8 @@ int dw_mci_probe(struct dw_mci *host)
>>>       else
>>>               host->bus_hz = clk_get_rate(host->ciu_clk);
>>>
>>> -     if (host->drv_data->setup_clock) {
>>> -             ret = host->drv_data->setup_clock(host);
>>> +     if (drv_data && drv_data->setup_clock) {
>>> +             ret = drv_data->setup_clock(host);
>>>               if (ret) {
>>>                       dev_err(host->dev,
>>>                               "implementation specific clock setup failed\n");
>>>
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html


^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
  2012-10-29  9:34       ` James Hogan
@ 2012-10-29 13:39         ` Chris Ball
  -1 siblings, 0 replies; 13+ messages in thread
From: Chris Ball @ 2012-10-29 13:39 UTC (permalink / raw)
  To: James Hogan
  Cc: Will Newton, Jaehoon Chung, Thomas Abraham, Seungwon Jeon,
	linux-mmc, linux-kernel

Hi,

On Mon, Oct 29 2012, James Hogan wrote:
> On 17/10/12 10:11, Will Newton wrote:
>> Looks good to me too.
>> 
>> Acked-by: Will Newton <will.newton@imgtec.com>
>> 
>> On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
>>> Looks good to me.
>>>
>>> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
>
> Thanks for the acks Thomas, Seungwon, Jaehoon and Will.
>
> Chris: Any chance of queueing this patch for v3.7?

Yes, certainly -- pushed to mmc-next for 3.7, thanks.

- Chris.
-- 
Chris Ball   <cjb@laptop.org>   <http://printf.net/>
One Laptop Per Child

^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix multiple drv_data NULL dereferences
@ 2012-10-29 13:39         ` Chris Ball
  0 siblings, 0 replies; 13+ messages in thread
From: Chris Ball @ 2012-10-29 13:39 UTC (permalink / raw)
  To: James Hogan
  Cc: Will Newton, Jaehoon Chung, Thomas Abraham, Seungwon Jeon,
	linux-mmc, linux-kernel

Hi,

On Mon, Oct 29 2012, James Hogan wrote:
> On 17/10/12 10:11, Will Newton wrote:
>> Looks good to me too.
>> 
>> Acked-by: Will Newton <will.newton@imgtec.com>
>> 
>> On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
>>> Looks good to me.
>>>
>>> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
>
> Thanks for the acks Thomas, Seungwon, Jaehoon and Will.
>
> Chris: Any chance of queueing this patch for v3.7?

Yes, certainly -- pushed to mmc-next for 3.7, thanks.

- Chris.
-- 
Chris Ball   <cjb@laptop.org>   <http://printf.net/>
One Laptop Per Child

^ permalink raw reply	[flat|nested] 13+ messages in thread
* [PATCH] dw_mmc: fix more const pointer warnings
  2012-10-29 13:39         ` Chris Ball
  (?)
@ 2012-11-08 14:26         ` Arnd Bergmann
  2012-11-08 14:35           ` Chris Ball
  -1 siblings, 1 reply; 13+ messages in thread
From: Arnd Bergmann @ 2012-11-08 14:26 UTC (permalink / raw)
  To: Chris Ball
  Cc: James Hogan, Will Newton, Jaehoon Chung, Thomas Abraham,
	Seungwon Jeon, linux-mmc, linux-kernel

The patch "dw_mmc: fix multiple drv_data NULL dereferences" has
unfortunately clashed with my "mmc: dw_mmc: constify
dw_mci_idmac_ops in exynos back-end" patch, causing new warnings
to appear.

This should hopefully fix the issue for good.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
On Monday 29 October 2012, Chris Ball wrote:
> Hi,
> 
> On Mon, Oct 29 2012, James Hogan wrote:
> > On 17/10/12 10:11, Will Newton wrote:
> >> Looks good to me too.
> >> 
> >> Acked-by: Will Newton <will.newton@imgtec.com>
> >> 
> >> On Wed, Oct 17, 2012 at 3:06 AM, Jaehoon Chung <jh80.chung@samsung.com> wrote:
> >>> Looks good to me.
> >>>
> >>> Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
> >
> > Thanks for the acks Thomas, Seungwon, Jaehoon and Will.
> >
> > Chris: Any chance of queueing this patch for v3.7?
> 
> Yes, certainly -- pushed to mmc-next for 3.7, thanks.

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c0667c8..5b41348 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -232,7 +232,7 @@ static u32 dw_mci_prepare_command(struct mmc_host *mmc, struct mmc_command *cmd)
 {
 	struct mmc_data	*data;
 	struct dw_mci_slot *slot = mmc_priv(mmc);
-	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
+	const struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 cmdr;
 	cmd->error = -EINPROGRESS;
 
@@ -773,7 +773,7 @@ static void dw_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
 static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
 	struct dw_mci_slot *slot = mmc_priv(mmc);
-	struct dw_mci_drv_data *drv_data = slot->host->drv_data;
+	const struct dw_mci_drv_data *drv_data = slot->host->drv_data;
 	u32 regs;
 
 	/* set default 1 bit mode */
@@ -1817,7 +1817,7 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
 {
 	struct mmc_host *mmc;
 	struct dw_mci_slot *slot;
-	struct dw_mci_drv_data *drv_data = host->drv_data;
+	const struct dw_mci_drv_data *drv_data = host->drv_data;
 	int ctrl_id, ret;
 	u8 bus_width;
 
@@ -2038,7 +2038,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 	struct dw_mci_board *pdata;
 	struct device *dev = host->dev;
 	struct device_node *np = dev->of_node;
-	struct dw_mci_drv_data *drv_data = host->drv_data;
+	const struct dw_mci_drv_data *drv_data = host->drv_data;
 	int idx, ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
@@ -2084,7 +2084,7 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
 
 int dw_mci_probe(struct dw_mci *host)
 {
-	struct dw_mci_drv_data *drv_data = host->drv_data;
+	const struct dw_mci_drv_data *drv_data = host->drv_data;
 	int width, i, ret = 0;
 	u32 fifo_size;
 	int init_slots = 0;

^ permalink raw reply related	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix more const pointer warnings
  2012-11-08 14:26         ` [PATCH] dw_mmc: fix more const pointer warnings Arnd Bergmann
@ 2012-11-08 14:35           ` Chris Ball
  2012-11-09  5:44             ` Jaehoon Chung
  0 siblings, 1 reply; 13+ messages in thread
From: Chris Ball @ 2012-11-08 14:35 UTC (permalink / raw)
  To: Arnd Bergmann
  Cc: James Hogan, Will Newton, Jaehoon Chung, Thomas Abraham,
	Seungwon Jeon, linux-mmc, linux-kernel

Hi Arnd,

On Thu, Nov 08 2012, Arnd Bergmann wrote:
> The patch "dw_mmc: fix multiple drv_data NULL dereferences" has
> unfortunately clashed with my "mmc: dw_mmc: constify
> dw_mci_idmac_ops in exynos back-end" patch, causing new warnings
> to appear.
>
> This should hopefully fix the issue for good.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Thanks, pushed to mmc-next for 3.7.

(Jaehoon also sent a patch to fix these last night, but yours applies to
current mmc-next and his doesn't, so I'll take this one instead.)

- Chris.
-- 
Chris Ball   <cjb@laptop.org>   <http://printf.net/>
One Laptop Per Child

^ permalink raw reply	[flat|nested] 13+ messages in thread
* Re: [PATCH] dw_mmc: fix more const pointer warnings
  2012-11-08 14:35           ` Chris Ball
@ 2012-11-09  5:44             ` Jaehoon Chung
  0 siblings, 0 replies; 13+ messages in thread
From: Jaehoon Chung @ 2012-11-09  5:44 UTC (permalink / raw)
  To: Chris Ball
  Cc: Arnd Bergmann, James Hogan, Will Newton, Jaehoon Chung,
	Thomas Abraham, Seungwon Jeon, linux-mmc, linux-kernel

Great..Thanks Arnd and Chris.

Best Regards,
Jaehoon Chung
On 11/08/2012 11:35 PM, Chris Ball wrote:
> Hi Arnd,
> 
> On Thu, Nov 08 2012, Arnd Bergmann wrote:
>> The patch "dw_mmc: fix multiple drv_data NULL dereferences" has
>> unfortunately clashed with my "mmc: dw_mmc: constify
>> dw_mci_idmac_ops in exynos back-end" patch, causing new warnings
>> to appear.
>>
>> This should hopefully fix the issue for good.
>>
>> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> 
> Thanks, pushed to mmc-next for 3.7.
> 
> (Jaehoon also sent a patch to fix these last night, but yours applies to
> current mmc-next and his doesn't, so I'll take this one instead.)
> 
> - Chris.
> 


^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2012-11-09  5:45 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-10-16  8:43 [PATCH] dw_mmc: fix multiple drv_data NULL dereferences James Hogan
2012-10-16  8:43 ` James Hogan
2012-10-16 10:49 ` Thomas Abraham
2012-10-16 10:54 ` Seungwon Jeon
2012-10-17  2:06 ` Jaehoon Chung
2012-10-17  9:11   ` Will Newton
2012-10-29  9:34     ` James Hogan
2012-10-29  9:34       ` James Hogan
2012-10-29 13:39       ` Chris Ball
2012-10-29 13:39         ` Chris Ball
2012-11-08 14:26         ` [PATCH] dw_mmc: fix more const pointer warnings Arnd Bergmann
2012-11-08 14:35           ` Chris Ball
2012-11-09  5:44             ` Jaehoon Chung

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.