From: Johan Hovold <johan@hovoldconsulting.com>
Date: Mon, 14 Sep 2015 18:19:03 +0000 (+0200)
Subject: greybus: sdio: fix tear-down use-after-free
X-Git-Tag: v4.9-rc1~119^2~378^2~21^2~1191
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=e5265266ec6360702feb6ff69d1aec9e318ae1f6;p=karo-tx-linux.git

greybus: sdio: fix tear-down use-after-free

The mmc-driver private data must not be accessed after mmc_free_host()
has released it.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---

diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c
index 24b2e3152fa1..14617e31782e 100644
--- a/drivers/staging/greybus/sdio.c
+++ b/drivers/staging/greybus/sdio.c
@@ -750,8 +750,8 @@ static void gb_sdio_connection_exit(struct gb_connection *connection)
 	flush_workqueue(gb_sdio_mrq_workqueue);
 	destroy_workqueue(gb_sdio_mrq_workqueue);
 	mmc_remove_host(mmc);
-	mmc_free_host(mmc);
 	kfree(host->xfer_buffer);
+	mmc_free_host(mmc);
 }
 
 static struct gb_protocol sdio_protocol = {