[lkml]   [2019]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[<PATCH v1> 5/9] mmc: core: fix one NULL pointer dereference after SD card is removed
From: Can Guo <>

After SD card is removed, the driver would mark its queue DYING to try to
block further more requests from coming into the queue, then clean up its
queue's queuedata by setting it to NULL. However, there can still be new
requests come in right before the DYING mark is set after SD card is
removed. When one new request is allocated and initialized, the queuedata
would be accessed. If queuedata has been cleaned up already, NULL pointer
dereference would happen. This change fixes it by checking if queuedata is
NULL before accessing it, if yes, then bails out with error.

mmc0: card aaaa removed
Buffer I/O error on dev mmcblk0p1, logical block 1, lost async page write
Unable to handle kernel NULL pointer dereference at virtual address
Mem abort info:
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 39-bit VAs, pgd = ffffffd7bbafa000
[0000000000000000] *pgd=0000000134331003, *pud=0000000134331003,
Internal error: Oops: 96000006 [#1] PREEMPT SMP
task: ffffffd77d193380 task.stack: ffffff8047e30000
pc : mmc_init_request+0x28/0x74
lr : alloc_request_size+0x4c/0x70
Process MediaScannerSer (pid: 4710, stack limit = 0xffffff8047e30000)
Call trace:

Signed-off-by: Can Guo <>
Signed-off-by: Sayali Lokhande <>
Signed-off-by: Bao D. Nguyen <>
drivers/mmc/core/queue.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 846557b..a1de5f7 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -211,8 +211,11 @@ static int __mmc_init_request(struct mmc_queue *mq, struct request *req,
gfp_t gfp)
struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
- struct mmc_card *card = mq->card;
- struct mmc_host *host = card->host;
+ struct mmc_host *host;
+ if (!mq)
+ return -ENODEV;
+ host = mq->card->host;

mq_rq->sg = mmc_alloc_sg(mmc_get_max_segments(host), gfp);
if (!mq_rq->sg)
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
 \ /
  Last update: 2019-12-17 03:54    [W:0.087 / U:3.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site