diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-09-14 21:19:03 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@google.com> | 2015-09-15 07:57:25 +0300 |
| commit | e5265266ec6360702feb6ff69d1aec9e318ae1f6 (patch) | |
| tree | f873e3cde621b50dfd1b97067b443e0feb1870d3 /drivers/staging/greybus/sdio.c | |
| parent | d7849bffc622b3405ef226364d67bb81af48c152 (diff) | |
| download | linux-e5265266ec6360702feb6ff69d1aec9e318ae1f6.tar.xz | |
greybus: sdio: fix tear-down use-after-free
The mmc-driver private data must not be accessed after mmc_free_host()
has released it.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/sdio.c')
| -rw-r--r-- | drivers/staging/greybus/sdio.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c index 24b2e3152fa1..14617e31782e 100644 --- a/drivers/staging/greybus/sdio.c +++ b/drivers/staging/greybus/sdio.c @@ -750,8 +750,8 @@ static void gb_sdio_connection_exit(struct gb_connection *connection) flush_workqueue(gb_sdio_mrq_workqueue); destroy_workqueue(gb_sdio_mrq_workqueue); mmc_remove_host(mmc); - mmc_free_host(mmc); kfree(host->xfer_buffer); + mmc_free_host(mmc); } static struct gb_protocol sdio_protocol = { |