Re: [PATCH v2] mmc: vub300: fix use-after-free in vub300 teardown

[Johan Hovold]

On Tue, Sep 08, 2026 at 12:09:00PM -0300, Adriano Cordova wrote:
> mmc_host_classdev_release() reads host->parent->of_node, but the
> parent is not guaranteed to outlive the host. Instead, store
> host->index_is_alias to avoid reading the parent at release time.
> 
> Also, call kref_put() after mmc_request_done(), as the latter
> dereferences the host pointer.

These are two separate issues and should be fixed separately.

> Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")

This is not the commit that introduced the of_node issue.

> Reported-by: syzbot+f312381a95cc080992fd@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://syzkaller.appspot.com/bug?extid=f312381a95cc080992fd
> Assisted-by: opencode: deepseek v4 flash
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Adriano Cordova <adrianox@xxxxxxxxx>
> ---
>  drivers/mmc/core/host.c   | 3 ++-
>  drivers/mmc/host/vub300.c | 4 ++--
>  include/linux/mmc/host.h  | 1 +
>  3 files changed, 5 insertions(+), 3 deletions(-)

Johan