summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGuennadi Liakhovetski <g.liakhovetski@gmx.de>2012-10-23 14:08:52 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-11-17 13:19:05 -0800
commit2d2db636c0f85a0fa4da6b6bc82d3474745b10de (patch)
tree75115a000a72d334ea077dda5a826c5d66669a5f
parentf98f5bfb851481d11b7395a9a2cd62ccdcf79d13 (diff)
downloadlwn-2d2db636c0f85a0fa4da6b6bc82d3474745b10de.tar.gz
lwn-2d2db636c0f85a0fa4da6b6bc82d3474745b10de.zip
mmc: sh_mmcif: fix use after free
commit a0d28ba01ebd048b4ba418142b37f5cf80e6d156 upstream. A recent commit "mmc: sh_mmcif: fix clock management" has introduced a use after free bug in sh_mmcif.c: in sh_mmcif_remove() the call to mmc_free_host() frees private driver data, therefore using it afterwards is a bug. Revert that hunk. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Chris Ball <cjb@laptop.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/mmc/host/sh_mmcif.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index ba0e493ad0c6..9058d21ae5d8 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -1464,9 +1464,9 @@ static int __devexit sh_mmcif_remove(struct platform_device *pdev)
platform_set_drvdata(pdev, NULL);
+ clk_disable(host->hclk);
mmc_free_host(host->mmc);
pm_runtime_put_sync(&pdev->dev);
- clk_disable(host->hclk);
pm_runtime_disable(&pdev->dev);
return 0;