On Mon, Dec 07, 2015 at 05:10:29PM +0100, Ulf Hansson wrote: > On 7 December 2015 at 12:15, Russell King <rmk+kernel@xxxxxxxxxxxxxxxx> wrote: > > MMC probe cleanup is racy: consider the following sequence: > > > > - mmc_alloc_host() > > - mmc_gpio_request_cd() > > - some failure > > - mmc_free_host() > > > > mmc_gpio_request_cd() registers a handler for the card detect GPIO > > signal, and if this is triggered, it can queue the delayed work in > > mmc_gpio_request_cd() requests the GPIO, but doesn't request the IRQ. > Instead that's delayed until mmc_add_host() is called. > > > struct mmc_host. mmc_free_host() then frees the mmc_host structure > > with the still queued delayed work, which will then cause the timer > > subsystem to touch free'd memory, potentially oopsing the kernel. > > Because of the above, I don't think this can happen.. > > ...unless there are some specific cases when hosts dealing with > registering the GPIO CD irq themselves, is that so? This is over a year old, and I forget the details now. I'll drop the patch for now. -- RMK's Patch system: http://www.arm.linux.org.uk/developer/patches/ FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up according to speedtest.net. -- To unsubscribe from this list: send the line "unsubscribe linux-mmc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
