diff options
| author | Pavan Anamula <pavana@codeaurora.org> | 2016-03-30 22:07:56 +0530 |
|---|---|---|
| committer | Kyle Yan <kyan@codeaurora.org> | 2016-06-13 19:06:18 -0700 |
| commit | 3c7b269a36603dfe569cb1e84c1753916c4c8fdc (patch) | |
| tree | ede5477195055150677b300ed2717cce0996b187 /drivers | |
| parent | 9ed18dec09251d8d1d177f9ab0d95f61277d7769 (diff) | |
drivers: mmc: fix issue raised by source code analyzer tool
Fix the below reported issues by source code analyzer.
1) Pointer 'ext_csd' returned from call to function 'mmc_get_ext_csd'
may be NULL and will be dereferenced at ext_csd[EXT_CSD_CMDQ] in
mmc_test_awake_ext_csd(), causing NUll pointer derefernce.
2) Array 'sdhci_slot' of size 2 may use index value(s) -1 as below,
when ret = 0.
sdhci_slot[ret-1] = msm_host;
3) Variable 'host->lock' locked ,And was not unlocked when below
condition occurs in sdhci_irq().
if (!mmc_card_and_host_support_async_int(host->mmc))
return IRQ_NONE;
CRs-Fixed: 1000387
Change-Id: Iec6ecef1bf940e720c871be58b265394904f0cf1
Signed-off-by: Pavan Anamula <pavana@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mmc/core/mmc.c | 2 | ||||
| -rw-r--r-- | drivers/mmc/host/sdhci-msm.c | 2 | ||||
| -rw-r--r-- | drivers/mmc/host/sdhci.c | 4 |
3 files changed, 5 insertions, 3 deletions
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c index e3760d8a8741..7388416ba74d 100644 --- a/drivers/mmc/core/mmc.c +++ b/drivers/mmc/core/mmc.c @@ -2439,7 +2439,7 @@ static int mmc_test_awake_ext_csd(struct mmc_host *host) struct mmc_card *card = host->card; err = mmc_get_ext_csd(card, &ext_csd); - if (err) { + if (err || !ext_csd) { pr_err("%s: %s: mmc_get_ext_csd failed (%d)\n", mmc_hostname(host), __func__, err); return err; diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c index f3cc5ed87c59..45414d7905d7 100644 --- a/drivers/mmc/host/sdhci-msm.c +++ b/drivers/mmc/host/sdhci-msm.c @@ -3936,7 +3936,7 @@ static int sdhci_msm_probe(struct platform_device *pdev) /* Extract platform data */ if (pdev->dev.of_node) { ret = of_alias_get_id(pdev->dev.of_node, "sdhc"); - if (ret < 0) { + if (ret <= 0) { dev_err(&pdev->dev, "Failed to get slot index %d\n", ret); goto pltfm_free; diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c index 34f8ae4ab105..821f9ae46f83 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c @@ -3089,8 +3089,10 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id) if (!host->clock && host->mmc->card && mmc_card_sdio(host->mmc->card)) { - if (!mmc_card_and_host_support_async_int(host->mmc)) + if (!mmc_card_and_host_support_async_int(host->mmc)) { + spin_unlock(&host->lock); return IRQ_NONE; + } /* * async card interrupt is level sensitive and received * when clocks are off. |