diff options
| author | Magnus Damm <damm@opensource.se> | 2009-03-11 21:59:03 +0900 |
|---|---|---|
| committer | Pierre Ossman <drzeus@drzeus.cx> | 2009-03-24 21:30:03 +0100 |
| commit | bedcc45c2e5d72b1c4b087b725c391441a93eee6 (patch) | |
| tree | 366a7472ebe65f9bba02d3599282022ca120ac72 /drivers/mmc | |
| parent | bc6772a023ceab8df404b18b31c27f764dcf5b3f (diff) | |
| download | op-kernel-dev-bedcc45c2e5d72b1c4b087b725c391441a93eee6.zip op-kernel-dev-bedcc45c2e5d72b1c4b087b725c391441a93eee6.tar.gz | |
tmio_mmc: Fix use after free in remove()
Update the tmio_mmc code to call mmc_free_host() when
done using the private data. Without this fix the driver
frees memory and then keeps on using it as private data.
Signed-off-by: Magnus Damm <damm@opensource.se>
Acked-by: Ian Molton <ian@mnementh.co.uk>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Diffstat (limited to 'drivers/mmc')
| -rw-r--r-- | drivers/mmc/host/tmio_mmc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c index 4f3e265..63fbd5b 100644 --- a/drivers/mmc/host/tmio_mmc.c +++ b/drivers/mmc/host/tmio_mmc.c @@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev) if (mmc) { struct tmio_mmc_host *host = mmc_priv(mmc); mmc_remove_host(mmc); - mmc_free_host(mmc); free_irq(host->irq, host); iounmap(host->ctl); iounmap(host->cnf); + mmc_free_host(mmc); } return 0; |
