Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754447AbZCKO2c (ORCPT ); Wed, 11 Mar 2009 10:28:32 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754250AbZCKO2S (ORCPT ); Wed, 11 Mar 2009 10:28:18 -0400 Received: from mail.mnementh.co.uk ([173.45.232.4]:57830 "EHLO mnementh.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753574AbZCKO2R (ORCPT ); Wed, 11 Mar 2009 10:28:17 -0400 X-Greylist: delayed 354 seconds by postgrey-1.27 at vger.kernel.org; Wed, 11 Mar 2009 10:28:03 EDT Message-ID: <49B7CA78.9010807@mnementh.co.uk> Date: Wed, 11 Mar 2009 14:28:08 +0000 From: Ian Molton User-Agent: Mozilla-Thunderbird 2.0.0.19 (X11/20090103) MIME-Version: 1.0 To: Magnus Damm CC: linux-kernel@vger.kernel.org, drzeus-wbsd@drzeus.cx, akpm@linux-foundation.org Subject: Re: [PATCH 02/05] tmio_mmc: Fix use after free in remove() References: <20090311125845.1563.31960.sendpatchset@rx1.opensource.se> <20090311125903.1563.71042.sendpatchset@rx1.opensource.se> In-Reply-To: <20090311125903.1563.71042.sendpatchset@rx1.opensource.se> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1112 Lines: 37 Magnus Damm wrote: > From: Magnus Damm > > Update the tmio_mmc code to call mmc_free_host() when > done using the private data. Without this fix the driver > frees memory and then keeps on using it as private data. > > Signed-off-by: Magnus Damm Acked-by: Ian Molton > --- > > drivers/mmc/host/tmio_mmc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- 0010/drivers/mmc/host/tmio_mmc.c > +++ work/drivers/mmc/host/tmio_mmc.c 2009-03-11 19:24:03.000000000 +0900 > @@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(str > if (mmc) { > struct tmio_mmc_host *host = mmc_priv(mmc); > mmc_remove_host(mmc); > - mmc_free_host(mmc); > free_irq(host->irq, host); > iounmap(host->ctl); > iounmap(host->cnf); > + mmc_free_host(mmc); > } > > return 0; > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/