aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorMagnus Damm <damm@opensource.se>2009-03-11 21:59:03 +0900
committerPierre Ossman <drzeus@drzeus.cx>2009-03-24 21:30:03 +0100
commitbedcc45c2e5d72b1c4b087b725c391441a93eee6 (patch)
tree366a7472ebe65f9bba02d3599282022ca120ac72 /drivers
parentbc6772a023ceab8df404b18b31c27f764dcf5b3f (diff)
tmio_mmc: Fix use after free in remove()
Update the tmio_mmc code to call mmc_free_host() when done using the private data. Without this fix the driver frees memory and then keeps on using it as private data. Signed-off-by: Magnus Damm <damm@opensource.se> Acked-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/mmc/host/tmio_mmc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 4f3e265d020..63fbd5b7d31 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev)
if (mmc) {
struct tmio_mmc_host *host = mmc_priv(mmc);
mmc_remove_host(mmc);
- mmc_free_host(mmc);
free_irq(host->irq, host);
iounmap(host->ctl);
iounmap(host->cnf);
+ mmc_free_host(mmc);
}
return 0;