diff options
| author | Adrian Hunter <adrian.hunter@nokia.com> | 2011-05-06 12:14:11 +0300 |
|---|---|---|
| committer | Chris Ball <cjb@laptop.org> | 2011-07-21 10:35:04 -0400 |
| commit | 770d7432009c8bc89cf72d47313866adf600c66a (patch) | |
| tree | bfd5ec0bff4f022e8fd713e8b61bcf4bb04f901f | |
| parent | 3796fb8ac40920e04ed36e45b1b40d13aec3909d (diff) | |
mmc: omap_hsmmc: fix oops in omap_hsmmc_dma_cb()
In the case of an I/O error, the DMA will have been cleaned up in
the MMC interrupt and the request structure pointer will be null.
In that case, it is essential to check if the DMA is over before
dereferencing host->mrq->data.
Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
| -rw-r--r-- | drivers/mmc/host/omap_hsmmc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c index f82a0535afd..21e4a799df4 100644 --- a/drivers/mmc/host/omap_hsmmc.c +++ b/drivers/mmc/host/omap_hsmmc.c @@ -1369,7 +1369,7 @@ static void omap_hsmmc_config_dma_params(struct omap_hsmmc_host *host, static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data) { struct omap_hsmmc_host *host = cb_data; - struct mmc_data *data = host->mrq->data; + struct mmc_data *data; int dma_ch, req_in_progress; if (!(ch_status & OMAP_DMA_BLOCK_IRQ)) { @@ -1384,6 +1384,7 @@ static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data) return; } + data = host->mrq->data; host->dma_sg_idx++; if (host->dma_sg_idx < host->dma_len) { /* Fire up the next transfer. */ |