mmc: msm_sdcc: Fix null pointer dereference in msmsdcc_pio_irq()
In a case where, the data transfer is scheduled in PIO mode, the write
data pend feature is enabled and the command corresponding to the data
transfer is timedout, it can happen that the failure recovery mechanism
clears the internal data transfer structure but not the PIO IRQ mask.
Since the msmsdcc_irq() and msmsdcc_pio_irq() are shared IRQ handlers,
the data structures free'd in command timeout interrupt routine might
be accessed in the msmsdcc_pio_irq() causing NULL pointer dereference.
Fix this by clearing PIO IRQ mask before stopping the data transfer.
CRs-Fixed: 498700
Change-Id: If597eed5da1707b8cbfb2c9c305719bf21d0eec5
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
1 file changed