瀏覽代碼

mmc: block: blk-mq: Potential NULL deref on mmc_blk_alloc_req() failure

mmc_blk_alloc_req() is supposed to return error pointers but there is
one path where we forget to set the error code and accidentally return
NULL.  The callers are not expecting that and will have a NULL pointer
dereference.

Fixes: 41e3efd07d5a ("mmc: block: Simplify cleaning up the queue")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Dan Carpenter 7 年之前
父節點
當前提交
2361bfb055
共有 1 個文件被更改,包括 1 次插入0 次删除
  1. 1 0
      drivers/mmc/core/block.c

+ 1 - 0
drivers/mmc/core/block.c

@@ -2328,6 +2328,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
 	 */
 	 */
 	if (!blk_get_queue(md->queue.queue)) {
 	if (!blk_get_queue(md->queue.queue)) {
 		mmc_cleanup_queue(&md->queue);
 		mmc_cleanup_queue(&md->queue);
+		ret = -ENODEV;
 		goto err_putdisk;
 		goto err_putdisk;
 	}
 	}