From bc6772a023ceab8df404b18b31c27f764dcf5b3f Mon Sep 17 00:00:00 2001 From: Magnus Damm Date: Wed, 11 Mar 2009 21:58:54 +0900 Subject: tmio_mmc: Fix one off, use resource_size() in probe() Update the tmio_mmc code to use resource_size(). With this patch applied the correct resource size is passed to ioremap(). Signed-off-by: Magnus Damm Acked-by: Ian Molton Signed-off-by: Pierre Ossman --- drivers/mmc/host/tmio_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/mmc/host/tmio_mmc.c') diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c index 6a7a61904833..4f3e265d0203 100644 --- a/drivers/mmc/host/tmio_mmc.c +++ b/drivers/mmc/host/tmio_mmc.c @@ -568,11 +568,11 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev) host->mmc = mmc; platform_set_drvdata(dev, mmc); - host->ctl = ioremap(res_ctl->start, res_ctl->end - res_ctl->start); + host->ctl = ioremap(res_ctl->start, resource_size(res_ctl)); if (!host->ctl) goto host_free; - host->cnf = ioremap(res_cnf->start, res_cnf->end - res_cnf->start); + host->cnf = ioremap(res_cnf->start, resource_size(res_cnf)); if (!host->cnf) goto unmap_ctl; -- cgit v1.2.1 From bedcc45c2e5d72b1c4b087b725c391441a93eee6 Mon Sep 17 00:00:00 2001 From: Magnus Damm Date: Wed, 11 Mar 2009 21:59:03 +0900 Subject: tmio_mmc: Fix use after free in remove() Update the tmio_mmc code to call mmc_free_host() when done using the private data. Without this fix the driver frees memory and then keeps on using it as private data. Signed-off-by: Magnus Damm Acked-by: Ian Molton Signed-off-by: Pierre Ossman --- drivers/mmc/host/tmio_mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mmc/host/tmio_mmc.c') diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c index 4f3e265d0203..63fbd5b7d312 100644 --- a/drivers/mmc/host/tmio_mmc.c +++ b/drivers/mmc/host/tmio_mmc.c @@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev) if (mmc) { struct tmio_mmc_host *host = mmc_priv(mmc); mmc_remove_host(mmc); - mmc_free_host(mmc); free_irq(host->irq, host); iounmap(host->ctl); iounmap(host->cnf); + mmc_free_host(mmc); } return 0; -- cgit v1.2.1