From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , alan@lxorguk.ukuu.org.uk, Guennadi Liakhovetski , Chris Ball Subject: [ 58/66] mmc: sh_mmcif: fix use after free Date: Wed, 14 Nov 2012 20:11:03 -0800 Message-Id: <20121115040943.335940983@linuxfoundation.org> In-Reply-To: <20121115040939.016421011@linuxfoundation.org> References: <20121115040939.016421011@linuxfoundation.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: 3.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guennadi Liakhovetski commit a0d28ba01ebd048b4ba418142b37f5cf80e6d156 upstream. A recent commit "mmc: sh_mmcif: fix clock management" has introduced a use after free bug in sh_mmcif.c: in sh_mmcif_remove() the call to mmc_free_host() frees private driver data, therefore using it afterwards is a bug. Revert that hunk. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman --- drivers/mmc/host/sh_mmcif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/mmc/host/sh_mmcif.c +++ b/drivers/mmc/host/sh_mmcif.c @@ -1464,9 +1464,9 @@ static int __devexit sh_mmcif_remove(str platform_set_drvdata(pdev, NULL); + clk_disable(host->hclk); mmc_free_host(host->mmc); pm_runtime_put_sync(&pdev->dev); - clk_disable(host->hclk); pm_runtime_disable(&pdev->dev); return 0;