linux-kernel - [PATCH 4.5 203/238] mmc: atmel-mci: Check pdata for NULL before dereferencing it at DMA config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160410183507.358204470@linuxfoundation.org>
Date:	Sun, 10 Apr 2016 11:36:20 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	linux-kernel@...r.kernel.org
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	stable@...r.kernel.org, Brent Taylor <motobud@...il.com>,
	Ulf Hansson <ulf.hansson@...aro.org>
Subject: [PATCH 4.5 203/238] mmc: atmel-mci: Check pdata for NULL before dereferencing it at DMA config

4.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brent Taylor <motobud@...il.com>

commit 93c77d2999b09f2084b033ea6489915e0104ad9c upstream.

Using an at91sam9g20ek development board with DTS configuration may trigger
a kernel panic because of a NULL pointer dereference exception, while
configuring DMA. Let's fix this by adding a check for pdata before
dereferencing it.

Signed-off-by: Brent Taylor <motobud@...il.com>
Signed-off-by: Ulf Hansson <ulf.hansson@...aro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 drivers/mmc/host/atmel-mci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -2443,7 +2443,7 @@ static int atmci_configure_dma(struct at
 		struct mci_platform_data *pdata = host->pdev->dev.platform_data;
 		dma_cap_mask_t mask;
 
-		if (!pdata->dma_filter)
+		if (!pdata || !pdata->dma_filter)
 			return -ENODEV;
 
 		dma_cap_zero(mask);