Commit a0d28ba0 authored Oct 23, 2012 by Guennadi Liakhovetski Committed by Chris Ball Nov 07, 2012

mmc: sh_mmcif: fix use after free



A recent commit "mmc: sh_mmcif: fix clock management" has introduced a
use after free bug in sh_mmcif.c: in sh_mmcif_remove() the call to
mmc_free_host() frees private driver data, therefore using it afterwards
is a bug. Revert that hunk.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Cc: stable@vger.kernel.org [3.6]
Signed-off-by: Chris Ball <cjb@laptop.org>

parent 90b3e6c5

drivers/mmc/host/sh_mmcif.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1466,9 +1466,9 @@ static int __devexit sh_mmcif_remove(struct platform_device *pdev)

	platform_set_drvdata(pdev, NULL);		platform_set_drvdata(pdev, NULL);

			clk_disable(host->hclk);
	mmc_free_host(host->mmc);		mmc_free_host(host->mmc);
	pm_runtime_put_sync(&pdev->dev);		pm_runtime_put_sync(&pdev->dev);
	clk_disable(host->hclk);
	pm_runtime_disable(&pdev->dev);		pm_runtime_disable(&pdev->dev);

	return 0;		return 0;