From 9d53f7d49069e8692a717e73ddbe00250c832e26 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 17 May 2022 14:41:34 +0800 Subject: [PATCH] moxart: fix potential use-after-free on remove path stable inclusion from stable-v5.10.100 commit be93028d306dac9f5b59ebebd9ec7abcfc69c156 bugzilla: https://gitee.com/openeuler/kernel/issues/I55O9Y Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=be93028d306dac9f5b59ebebd9ec7abcfc69c156 -------------------------------- commit bd2db32e7c3e35bd4d9b8bbff689434a50893546 upstream. It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base register of the device and using it instead of the pointer dereference. Cc: Ulf Hansson Cc: Xiyu Yang Cc: Xin Xiong Cc: Xin Tan Cc: Tony Lindgren Cc: Yang Li Cc: linux-mmc@vger.kernel.org Cc: stable Reported-by: whitehat002 Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20220127071638.4057899-1-gregkh@linuxfoundation.org Signed-off-by: Ulf Hansson Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yu Liao Reviewed-by: Wei Li Signed-off-by: Zheng Zengkai --- drivers/mmc/host/moxart-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c index 7697068ad969..ea67a7ef2390 100644 --- a/drivers/mmc/host/moxart-mmc.c +++ b/drivers/mmc/host/moxart-mmc.c @@ -708,12 +708,12 @@ static int moxart_remove(struct platform_device *pdev) if (!IS_ERR_OR_NULL(host->dma_chan_rx)) dma_release_channel(host->dma_chan_rx); mmc_remove_host(mmc); - mmc_free_host(mmc); writel(0, host->base + REG_INTERRUPT_MASK); writel(0, host->base + REG_POWER_CONTROL); writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF, host->base + REG_CLOCK_CONTROL); + mmc_free_host(mmc); return 0; } -- GitLab