[lkml]   [2019]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 1/2] mmc: v4.14: Fix null pointer dereference in mmc_init_request
It is possible for queuedata to be cleared in mmc_cleanup_queue before
the request has been started. This will result in dereferencing a null

Signed-off-by: Raul E Rangel <>
I think we should cherry-pick 41e3efd07d5a02c80f503e29d755aa1bbb4245de into 4.14. It fixes a
potential resource leak when shutting down the request queue. Once this
patch is applied, there is a potential for a null pointer dereference.
That's what this patch fixes. The next patch is just an optimization to
stop processing earlier.

See for the initial

This commit applies to v4.14.116.

This doesn't apply to 5.1 since mmc has been migrated to blk-mq.


drivers/mmc/core/queue.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 0a4e77a5ba33..4bf1a9c6440b 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -159,8 +159,14 @@ static int mmc_init_request(struct request_queue *q, struct request *req,
struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
struct mmc_queue *mq = q->queuedata;
- struct mmc_card *card = mq->card;
- struct mmc_host *host = card->host;
+ struct mmc_card *card;
+ struct mmc_host *host;
+ if (!mq)
+ return -ENODEV;
+ card = mq->card;
+ host = card->host;

mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
if (!mq_rq->sg)
 \ /
  Last update: 2019-05-08 20:59    [W:0.072 / U:3.620 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site