mmc: omap_hsmmc: fix oops in omap_hsmmc_dma_cb()

In the case of an I/O error, the DMA will have been cleaned up in
the MMC interrupt and the request structure pointer will be null.

In that case, it is essential to check if the DMA is over before
dereferencing host->mrq->data.

Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Signed-off-by: Chris Ball <cjb@laptop.org>

diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index f82a0535afd132e58082d4984e5528f1e447457a..21e4a799df48b49bdbea53cefbc671375e944bf4 100644 (file)
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1369,7 +1369,7 @@ static void omap_hsmmc_config_dma_params(struct omap_hsmmc_host *host,
 static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data)
 {
        struct omap_hsmmc_host *host = cb_data;
-       struct mmc_data *data = host->mrq->data;
+       struct mmc_data *data;
        int dma_ch, req_in_progress;
 
        if (!(ch_status & OMAP_DMA_BLOCK_IRQ)) {
@@ -1384,6 +1384,7 @@ static void omap_hsmmc_dma_cb(int lch, u16 ch_status, void *cb_data)
                return;
        }
 
+       data = host->mrq->data;
        host->dma_sg_idx++;
        if (host->dma_sg_idx < host->dma_len) {
                /* Fire up the next transfer. */