mmc: vub300: fix NULL-deref on disconnect

commit dff34ef879c5e73298443956a8b391311ba78d57 upstream.

Make sure to deregister the controller before dropping the reference to
the driver data on disconnect to avoid NULL-pointer dereferences or
use-after-free.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 05ffd5bf5a6f0613a442a061e1fc081ad263c046..90c31803066d18ce69481a854a57c5c21a1fe288 100644 (file)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2371,8 +2371,8 @@ static void vub300_disconnect(struct usb_interface *interface)
                        usb_set_intfdata(interface, NULL);
                        /* prevent more I/O from starting */
                        vub300->interface = NULL;
-                       kref_put(&vub300->kref, vub300_delete);
                        mmc_remove_host(mmc);
+                       kref_put(&vub300->kref, vub300_delete);
                        pr_info("USB vub300 remote SDIO host controller[%d]"
                                " now disconnected", ifnum);
                        return;