linux-kernel - [PATCH] mmc: core: Fix null pointer dereference in bus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 19 Jan 2024 16:32:47 +0900
From: Seunghui Lee <sh043.lee@...sung.com>
To: linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org,
	ulf.hansson@...aro.org, gregkh@...uxfoundation.org, avri.altman@....com
Cc: grant.jung@...sung.com, jt77.jang@...sung.com, dh0421.hwang@...sung.com,
	junwoo80.lee@...sung.com, jangsub.yi@...sung.com, cw9316.lee@...sung.com,
	sh8267.baek@...sung.com, wkon.kim@...sung.com, Seunghui Lee
	<sh043.lee@...sung.com>
Subject: [PATCH] mmc: core: Fix null pointer dereference in bus_shutdown

When shutting down removable device,
it can be occurred null pointer dereference.

To prevent null pointer dereference,
At first, check null pointer.
Next, block rescan worker to scan removable device during shutdown.

Signed-off-by: Seunghui Lee <sh043.lee@...sung.com>
---
 drivers/mmc/core/bus.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index 0af96548e7da..4f370a6577aa 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -143,9 +143,17 @@ static void mmc_bus_shutdown(struct device *dev)
 {
 	struct mmc_driver *drv = to_mmc_driver(dev->driver);
 	struct mmc_card *card = mmc_dev_to_card(dev);
-	struct mmc_host *host = card->host;
+	struct mmc_host *host;
 	int ret;
 
+	if (!drv || !card) {
+		pr_debug("%s: drv or card is NULL.\n", dev_name(dev));
+		return;
+	}
+
+	host = card->host;
+	host->rescan_disable = 1;
+
 	if (dev->driver && drv->shutdown)
 		drv->shutdown(card);
 
-- 
2.29.0