From e5265266ec6360702feb6ff69d1aec9e318ae1f6 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Mon, 14 Sep 2015 20:19:03 +0200 Subject: [PATCH] greybus: sdio: fix tear-down use-after-free The mmc-driver private data must not be accessed after mmc_free_host() has released it. Signed-off-by: Johan Hovold Reviewed-by: Viresh Kumar Signed-off-by: Greg Kroah-Hartman --- drivers/staging/greybus/sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c index 24b2e3152fa1..14617e31782e 100644 --- a/drivers/staging/greybus/sdio.c +++ b/drivers/staging/greybus/sdio.c @@ -750,8 +750,8 @@ static void gb_sdio_connection_exit(struct gb_connection *connection) flush_workqueue(gb_sdio_mrq_workqueue); destroy_workqueue(gb_sdio_mrq_workqueue); mmc_remove_host(mmc); - mmc_free_host(mmc); kfree(host->xfer_buffer); + mmc_free_host(mmc); } static struct gb_protocol sdio_protocol = { -- 2.39.5