lkml.org 
[lkml]   [2009]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 02/05] tmio_mmc: Fix use after free in remove()
Magnus Damm wrote:
> From: Magnus Damm <damm@opensource.se>
>
> Update the tmio_mmc code to call mmc_free_host() when
> done using the private data. Without this fix the driver
> frees memory and then keeps on using it as private data.
>
> Signed-off-by: Magnus Damm <damm@opensource.se>

Acked-by: Ian Molton <ian@mnementh.co.uk>

> ---
>
> drivers/mmc/host/tmio_mmc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- 0010/drivers/mmc/host/tmio_mmc.c
> +++ work/drivers/mmc/host/tmio_mmc.c 2009-03-11 19:24:03.000000000 +0900
> @@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(str
> if (mmc) {
> struct tmio_mmc_host *host = mmc_priv(mmc);
> mmc_remove_host(mmc);
> - mmc_free_host(mmc);
> free_irq(host->irq, host);
> iounmap(host->ctl);
> iounmap(host->cnf);
> + mmc_free_host(mmc);
> }
>
> return 0;
>



\
 
 \ /
  Last update: 2009-03-11 15:31    [W:0.131 / U:3.360 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site