mmc: block: Fix use-after-free issue for rpmb
authorPeng Hao <richard.peng@oppo.com>
Fri, 22 May 2020 09:29:25 +0000 (09:29 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 3 Jun 2020 06:21:20 +0000 (08:21 +0200)
commita971f71e91fb7987b077e36d32fa4d32ff8fa470
tree6e09ba11cdde1a794cb11e7b5a18a17bd7cd0016
parent2de6df8df9bde3fda53083fa9d06b844ffbd60d5
mmc: block: Fix use-after-free issue for rpmb

[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]

The data structure member “rpmb->md” was passed to a call of the function
“mmc_blk_put” after a call of the function “put_device”. Reorder these
function calls to keep the data accesses consistent.

Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
Signed-off-by: Peng Hao <richard.peng@oppo.com>
Cc: stable@vger.kernel.org
[Uffe: Fixed up mangled patch and updated commit message]
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/mmc/core/block.c