Linux-mmc Archive on
 help / color / Atom feed
From: Sasha Levin <>
Cc: Pan Bian <>,
	Ulf Hansson <>,
	Sasha Levin <>,
Subject: [PATCH AUTOSEL 4.19 336/671] mmc: core: fix possible use after free of host
Date: Thu, 16 Jan 2020 11:59:34 -0500
Message-ID: <> (raw)
In-Reply-To: <>

From: Pan Bian <>

[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ]

In the function mmc_alloc_host, the function put_device is called to
release allocated resources when mmc_gpio_alloc fails. Finally, the
function pointed by host->class_dev.class->dev_release (i.e.,
mmc_host_classdev_release) is used to release resources including the
host structure. However, after put_device, host is used and released
again. Resulting in a use-after-free bug.

Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
Signed-off-by: Pan Bian <>
Signed-off-by: Ulf Hansson <>
Signed-off-by: Sasha Levin <>
 drivers/mmc/core/host.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index f57f5de54206..dd1c14d8f686 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -385,8 +385,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 	if (mmc_gpio_alloc(host)) {
-		ida_simple_remove(&mmc_host_ida, host->index);
-		kfree(host);
 		return NULL;

       reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <>
2020-01-16 16:59 ` Sasha Levin [this message]
2020-01-16 17:04 ` [PATCH AUTOSEL 4.19 647/671] mmc: sdio: fix wl1251 vendor id Sasha Levin
2020-01-16 17:04 ` [PATCH AUTOSEL 4.19 648/671] mmc: core: fix wl1251 sdio quirks Sasha Levin

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-mmc Archive on

Archives are clonable:
	git clone --mirror linux-mmc/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mmc linux-mmc/ \
	public-inbox-index linux-mmc

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone