提交 2361bfb0 编写于 作者: D Dan Carpenter 提交者: Ulf Hansson

mmc: block: blk-mq: Potential NULL deref on mmc_blk_alloc_req() failure

mmc_blk_alloc_req() is supposed to return error pointers but there is
one path where we forget to set the error code and accidentally return
NULL.  The callers are not expecting that and will have a NULL pointer
dereference.

Fixes: 41e3efd0 ("mmc: block: Simplify cleaning up the queue")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>
上级 0562315b
...@@ -2328,6 +2328,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card, ...@@ -2328,6 +2328,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
*/ */
if (!blk_get_queue(md->queue.queue)) { if (!blk_get_queue(md->queue.queue)) {
mmc_cleanup_queue(&md->queue); mmc_cleanup_queue(&md->queue);
ret = -ENODEV;
goto err_putdisk; goto err_putdisk;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册