moxart: fix potential use-after-free on remove path

It was reported that the mmc host structure could be accessed after it was freed in moxart_remove(), so fix this by saving the base register of the device and using it instead of the pointer dereference.

Cc Ulf Hansson <[email protected]>

Cc Xiyu Yang <[email protected]>

Cc Xin Xiong <[email protected]>

Cc Xin Tan <[email protected]>

Cc Tony Lindgren <[email protected]>

Cc Yang Li <[email protected]>

Cc [email protected]

Cc stable <[email protected]>

Reported-by whitehat002 <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
v2: changed to only move mmc_free_host() call as per Ulf's request

 drivers/mmc/host/moxart-mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/mmc/host/moxart-mmc.c +1 -2

index 16d1c7a43d33..b6eb75f4bbfc 100644
@@ -705,12 +705,12 @@ static int moxart_remove(struct platform_device *pdev)
        if (!IS_ERR_OR_NULL(host->dma_chan_rx))
                dma_release_channel(host->dma_chan_rx);
        mmc_remove_host(mmc);
-       mmc_free_host(mmc);
 
        writel(0, host->base + REG_INTERRUPT_MASK);
        writel(0, host->base + REG_POWER_CONTROL);
        writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
               host->base + REG_CLOCK_CONTROL);
+       mmc_free_host(mmc);
 
        return 0;
 }
--

2.35.0