Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bedcc45c authored by Magnus Damm's avatar Magnus Damm Committed by Pierre Ossman
Browse files

tmio_mmc: Fix use after free in remove() 



Update the tmio_mmc code to call mmc_free_host() when
done using the private data. Without this fix the driver
frees memory and then keeps on using it as private data.

Signed-off-by: default avatarMagnus Damm <damm@opensource.se>
Acked-by: default avatarIan Molton <ian@mnementh.co.uk>
Signed-off-by: default avatarPierre Ossman <drzeus@drzeus.cx>
parent bc6772a0

drivers/mmc/host/tmio_mmc.c

+1 −1
Original line number Diff line number Diff line
@@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev) 
	if (mmc) {

		struct tmio_mmc_host *host = mmc_priv(mmc);

		mmc_remove_host(mmc);

		mmc_free_host(mmc);

		free_irq(host->irq, host);

		iounmap(host->ctl);

		iounmap(host->cnf);

		mmc_free_host(mmc);

	}



	return 0;