In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mmc: davinci: avoid NULL deref of host->data in IRQ handler<\/p>\n
mmc_davinci_irq() returns early only when both host->cmd and
\nhost->data are NULL:<\/p>\n
if (host->cmd == NULL && host->data == NULL) {
\n …
\n return IRQ_NONE;
\n }<\/p>\n
So we may legitimately reach the rest of the handler with
\nhost->data == NULL (and therefore data == NULL). The DATDNE branch
\nalready guards against this with an explicit “if (data != NULL)”
\ncheck, but the subsequent TOUTRD (“read data timeout”) and
\nCRCWR\/CRCRD (“data CRC error”) branches dereference data
\nunconditionally:<\/p>\n
if (qstatus & MMCST0_TOUTRD) {
\n data->error = -ETIMEDOUT; error = -EILSEQ; data is NULL, the kernel
\nwill crash inside the IRQ handler. smatch flags this:<\/p>\n
drivers\/mmc\/host\/davinci_mmc.c:933 mmc_davinci_irq() error: we
\n previously assumed ‘data’ could be null (see line 914)<\/p>\n
Gate both branches on a non-NULL data, matching the existing pattern
\nused by the DATDNE branch.<\/p>\n
No functional change for callers where data is non-NULL, which is
\nthe only case in which these branches did meaningful work before
\nthis change.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mmc: davinci: avoid NULL deref of host->data in IRQ handler<\/p>\n
mmc_davinci_irq() returns early only when both host->cmd and
\nhost->dat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28734","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}