summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdrian Hunter <adrian.hunter@nokia.com>2011-05-06 12:14:11 +0300
committerChris Ball <cjb@laptop.org>2011-07-21 10:35:04 -0400
commit770d7432009c8bc89cf72d47313866adf600c66a (patch)
treebfd5ec0bff4f022e8fd713e8b61bcf4bb04f901f
parent3796fb8ac40920e04ed36e45b1b40d13aec3909d (diff)
downloadlinux-770d7432009c8bc89cf72d47313866adf600c66a.tar.bz2
mmc: omap_hsmmc: fix oops in omap_hsmmc_dma_cb()
In the case of an I/O error, the DMA will have been cleaned up in the MMC interrupt and the request structure pointer will be null. In that case, it is essential to check if the DMA is over before dereferencing host->mrq->data. Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com> Signed-off-by: Chris Ball <cjb@laptop.org>
-rw-r--r--drivers/mmc/host/omap_hsmmc.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index f82a0535afd1..21e4a799df48 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1369,7 +1369,7 @@ static void omap_hsmmc_config_dma_params(struct omap_hsmmc_host *host,
static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data)
{
struct omap_hsmmc_host *host = cb_data;
- struct mmc_data *data = host->mrq->data;
+ struct mmc_data *data;
int dma_ch, req_in_progress;
if (!(ch_status & OMAP_DMA_BLOCK_IRQ)) {
@@ -1384,6 +1384,7 @@ static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data)
return;
}
+ data = host->mrq->data;
host->dma_sg_idx++;
if (host->dma_sg_idx < host->dma_len) {
/* Fire up the next transfer. */