[U-Boot] [PATCH] mmc: mv_sdhci: fix uninitialized pointer deref on probe

[U-Boot] [PATCH] mmc: mv_sdhci: fix uninitialized pointer deref on probe

[Baruch Siach]

Since commit 3d296365e4e8 ("mmc: sdhci: Add support for
sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc
field. Move the mmc field initialization before sdhci_setup_cfg()
call to avoid crash on mmc pointer dereference.

Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask")
Cc: Faiz Abbas <faiz_abbas@ti.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
 drivers/mmc/mv_sdhci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/mv_sdhci.c b/drivers/mmc/mv_sdhci.c
index bf26d2e4e265..f5f3e4324719 100644
--- a/drivers/mmc/mv_sdhci.c
+++ b/drivers/mmc/mv_sdhci.c
@@ -114,6 +114,9 @@ static int mv_sdhci_probe(struct udevice *dev)
 	host->name = MVSDH_NAME;
 	host->ioaddr = (void *)devfdt_get_addr(dev);
 	host->quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | SDHCI_QUIRK_WAIT_SEND_CMD;
+	host->mmc = &plat->mmc;
+	host->mmc->dev = dev;
+	host->mmc->priv = host;
 
 	ret = sdhci_setup_cfg(&plat->cfg, host, 0, 0);
 	if (ret)
@@ -124,9 +127,6 @@ static int mv_sdhci_probe(struct udevice *dev)
 		sdhci_mvebu_mbus_config(host->ioaddr);
 	}
 
-	host->mmc = &plat->mmc;
-	host->mmc->dev = dev;
-	host->mmc->priv = host;
 	upriv->mmc = host->mmc;
 
 	return sdhci_probe(dev);
-- 
2.20.1

[U-Boot] [PATCH] mmc: mv_sdhci: fix uninitialized pointer deref on probe

[Peng Fan]

> Subject: [PATCH] mmc: mv_sdhci: fix uninitialized pointer deref on probe
> 
> Since commit 3d296365e4e8 ("mmc: sdhci: Add support for
> sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field.
> Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash
> on mmc pointer dereference.
> 
> Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask")
> Cc: Faiz Abbas <faiz_abbas@ti.com>
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  drivers/mmc/mv_sdhci.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/mmc/mv_sdhci.c b/drivers/mmc/mv_sdhci.c index
> bf26d2e4e265..f5f3e4324719 100644
> --- a/drivers/mmc/mv_sdhci.c
> +++ b/drivers/mmc/mv_sdhci.c
> @@ -114,6 +114,9 @@ static int mv_sdhci_probe(struct udevice *dev)
>  	host->name = MVSDH_NAME;
>  	host->ioaddr = (void *)devfdt_get_addr(dev);
>  	host->quirks = SDHCI_QUIRK_32BIT_DMA_ADDR |
> SDHCI_QUIRK_WAIT_SEND_CMD;
> +	host->mmc = &plat->mmc;
> +	host->mmc->dev = dev;
> +	host->mmc->priv = host;
> 
>  	ret = sdhci_setup_cfg(&plat->cfg, host, 0, 0);
>  	if (ret)
> @@ -124,9 +127,6 @@ static int mv_sdhci_probe(struct udevice *dev)
>  		sdhci_mvebu_mbus_config(host->ioaddr);
>  	}
> 
> -	host->mmc = &plat->mmc;
> -	host->mmc->dev = dev;
> -	host->mmc->priv = host;
>  	upriv->mmc = host->mmc;
> 
>  	return sdhci_probe(dev);

Applied to mmc/master.

Thanks,
Peng

> --
> 2.20.1