diff mbox series

mmc: fix use after free issue

Message ID HKAPR02MB429186300C2D9252A1D145BFE0B40@HKAPR02MB4291.apcprd02.prod.outlook.com (mailing list archive)
State New, archived
Headers show
Series mmc: fix use after free issue | expand

Commit Message

彭浩(Richard) May 22, 2020, 7:23 a.m. UTC 
This is caused by dereferencing 'rpmb' after put_device().

Signed-off-by: Peng Hao <richard.peng@oppo.com>
---
 drivers/mmc/core/block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--
2.7.4
diff mbox series

Patch

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 8499b56..e6e025c 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2483,8 +2483,8 @@  static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
 struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
   struct mmc_rpmb_data, chrdev);

-put_device(&rpmb->dev);
 mmc_blk_put(rpmb->md);
+put_device(&rpmb->dev);

 return 0;
 }