Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f5562d7 authored by Peng Hao's avatar Peng Hao Committed by Greg Kroah-Hartman
Browse files

mmc: block: Fix use-after-free issue for rpmb 



[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]

The data structure member “rpmb->md” was passed to a call of the function
“mmc_blk_put” after a call of the function “put_device”. Reorder these
function calls to keep the data accesses consistent.

Fixes: 1c87f735 ("mmc: block: Fix bug when removing RPMB chardev ")
Signed-off-by: default avatarPeng Hao <richard.peng@oppo.com>
Cc: stable@vger.kernel.org
[Uffe: Fixed up mangled patch and updated commit message]
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 78b83e79

drivers/mmc/core/block.c

+1 −1
Original line number Diff line number Diff line
@@ -2485,8 +2485,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp) 
	struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,

						  struct mmc_rpmb_data, chrdev);



	put_device(&rpmb->dev);

	mmc_blk_put(rpmb->md);

	put_device(&rpmb->dev);



	return 0;

}