[PATCH v3 1/2] mmc: vub300: fix use-after-free in vub300 teardown
From: Adriano Cordova
Date: Wed Sep 09 2026 - 07:42:21 EST
The request-completion paths call the final kref_put() before
mmc_request_done(). Dropping the last reference can free the host via
vub300_delete() -> mmc_free_host(), and mmc_request_done() then reads
the freed host.
Call mmc_request_done() before the final kref_put() so the host is
still valid.
Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Assisted-by: opencode: deepseek v4 flash
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Adriano Cordova <adrianox@xxxxxxxxx>
---
Changes since v1:
- Added Assisted-by tag
Changes since v2:
- Split patch into two logical patches
- Corrected the Fixes: tag
drivers/mmc/host/vub300.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 2dae474dcd06..c87c54aa0e99 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -1794,8 +1794,8 @@ static void vub300_cmndwork_thread(struct work_struct *work)
construct_request_response(vub300, cmd);
vub300->resp_len = 0;
mutex_unlock(&vub300->cmd_mutex);
- kref_put(&vub300->kref, vub300_delete);
mmc_request_done(vub300->mmc, req);
+ kref_put(&vub300->kref, vub300_delete);
return;
}
}
@@ -1946,8 +1946,8 @@ static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
satisfy_request_from_offloaded_data(vub300, cmd)) {
cmd->error = 0;
mutex_unlock(&vub300->cmd_mutex);
- kref_put(&vub300->kref, vub300_delete);
mmc_request_done(mmc, req);
+ kref_put(&vub300->kref, vub300_delete);
return;
} else {
vub300->cmd = cmd;
--
2.51.0