From: Guennadi Liakhovetski Date: Tue, 23 Oct 2012 12:08:52 +0000 (+0200) Subject: mmc: sh_mmcif: fix use after free X-Git-Tag: v3.7-rc5~8^2~7 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a0d28ba01ebd048b4ba418142b37f5cf80e6d156;p=profile%2Fivi%2Fkernel-adaptation-intel-automotive.git mmc: sh_mmcif: fix use after free A recent commit "mmc: sh_mmcif: fix clock management" has introduced a use after free bug in sh_mmcif.c: in sh_mmcif_remove() the call to mmc_free_host() frees private driver data, therefore using it afterwards is a bug. Revert that hunk. Signed-off-by: Guennadi Liakhovetski Cc: stable@vger.kernel.org [3.6] Signed-off-by: Chris Ball --- diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c index 11d2bc3..d25bc97 100644 --- a/drivers/mmc/host/sh_mmcif.c +++ b/drivers/mmc/host/sh_mmcif.c @@ -1466,9 +1466,9 @@ static int __devexit sh_mmcif_remove(struct platform_device *pdev) platform_set_drvdata(pdev, NULL); + clk_disable(host->hclk); mmc_free_host(host->mmc); pm_runtime_put_sync(&pdev->dev); - clk_disable(host->hclk); pm_runtime_disable(&pdev->dev); return 0;