Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Anastasia Belova <abelova@astralinux.ru>
To:     Ulf Hansson <ulf.hansson@linaro.org>
Cc:     Anastasia Belova <abelova@astralinux.ru>,
        Geert Uytterhoeven <geert+renesas@glider.be>,
        Jiasheng Jiang <jiasheng@iscas.ac.cn>,
        Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Teppei Kamijou <teppei.kamijou.yb@renesas.com>,
        Guennadi Liakhovetski <g.liakhovetski@gmx.de>,
        Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>,
        Chris Ball <cjb@laptop.org>,
        linux-mmc@vger.kernel.org (open list:MULTIMEDIA CARD (MMC), SECURE
        DIGITAL (SD) AND...), linux-kernel@vger.kernel.org (open list),
        lvc-project@linuxtesting.org
Subject: [PATCH] mmc: sh_mmcif: Add check for NULL for host->chan_yx and host->chan_rx in sh_mmcif_end_cmd
Date:   Thu, 17 Nov 2022 15:30:07 +0300
Message-Id: <20221117123007.13071-1-abelova@astralinux.ru>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Without these checks NULL-pointer may be dereferenced in
sh_mmcif_end_cmd parameters inside if (data->flags & MMC_DATA_READ).

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: eae309836509 ("mmc: sh_mmcif: Terminate DMA transactions when dete=
cting timeout or error")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
---
 drivers/mmc/host/sh_mmcif.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 0fd4c9d644dd..f35694acafcc 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -1136,14 +1136,17 @@ static bool sh_mmcif_end_cmd(struct sh_mmcif_host=
 *host)
 	time =3D wait_for_completion_interruptible_timeout(&host->dma_complete,
 							 host->timeout);
=20
-	if (data->flags & MMC_DATA_READ)
-		dma_unmap_sg(host->chan_rx->device->dev,
-			     data->sg, data->sg_len,
-			     DMA_FROM_DEVICE);
-	else
-		dma_unmap_sg(host->chan_tx->device->dev,
-			     data->sg, data->sg_len,
-			     DMA_TO_DEVICE);
+	if (data->flags & MMC_DATA_READ) {
+		if (host->chan_rx)
+			sh_mmcif_end_cmd(host->chan_rx->device->dev,
+					data->sg, data->sg_len,
+					DMA_FROM_DEVICE);
+	} else {
+		if (host->chan_tx)
+			dma_unmap_sg(host->chan_tx->device->dev,
+					data->sg, data->sg_len,
+					DMA_TO_DEVICE);
+	}
=20
 	if (host->sd_error) {
 		dev_err(host->mmc->parent,
--=20
2.30.2