Commit dff34ef8 authored by Johan Hovold's avatar Johan Hovold Committed by Ulf Hansson
Browse files

mmc: vub300: fix NULL-deref on disconnect 



Make sure to deregister the controller before dropping the reference to
the driver data on disconnect to avoid NULL-pointer dereferences or
use-after-free.

Fixes: 88095e7b ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
parent 5e3486e6

drivers/mmc/host/vub300.c

+1 −1
Original line number Diff line number Diff line
@@ -2365,8 +2365,8 @@ static void vub300_disconnect(struct usb_interface *interface) 
			usb_set_intfdata(interface, NULL);

			/* prevent more I/O from starting */

			vub300->interface = NULL;

			kref_put(&vub300->kref, vub300_delete);

			mmc_remove_host(mmc);

			kref_put(&vub300->kref, vub300_delete);

			pr_info("USB vub300 remote SDIO host controller[%d]"

				" now disconnected", ifnum);

			return;