mmc: vub300: fix NULL-deref on disconnect

Make sure to deregister the controller before dropping the reference to
the driver data on disconnect to avoid NULL-pointer dereferences or
use-after-free.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index ff49d0770506f740511ab5ba2c140b2116e99925..f173c7cf4e1a473aabe8668fe503a85b0df05d61 100644 (file)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2365,8 +2365,8 @@ static void vub300_disconnect(struct usb_interface *interface)
                        usb_set_intfdata(interface, NULL);
                        /* prevent more I/O from starting */
                        vub300->interface = NULL;
-                       kref_put(&vub300->kref, vub300_delete);
                        mmc_remove_host(mmc);
+                       kref_put(&vub300->kref, vub300_delete);
                        pr_info("USB vub300 remote SDIO host controller[%d]"
                                " now disconnected", ifnum);
                        return;