greybus: sdio: fix tear-down use-after-free

The mmc-driver private data must not be accessed after mmc_free_host()
has released it.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c
index 24b2e31..14617e3 100644 (file)
--- a/drivers/staging/greybus/sdio.c
+++ b/drivers/staging/greybus/sdio.c
@@ -750,8 +750,8 @@ static void gb_sdio_connection_exit(struct gb_connection *connection)
        flush_workqueue(gb_sdio_mrq_workqueue);
        destroy_workqueue(gb_sdio_mrq_workqueue);
        mmc_remove_host(mmc);
-       mmc_free_host(mmc);
        kfree(host->xfer_buffer);
+       mmc_free_host(mmc);
 }
 
 static struct gb_protocol sdio_protocol = {