tmio_mmc: Fix use after free in remove()

[safe/jmp/linux-2.6] / drivers / mmc / host / tmio_mmc.c

diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 4f3e265..63fbd5b 100644 (file)
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev)
        if (mmc) {
                struct tmio_mmc_host *host = mmc_priv(mmc);
                mmc_remove_host(mmc);
-               mmc_free_host(mmc);
                free_irq(host->irq, host);
                iounmap(host->ctl);
                iounmap(host->cnf);
+               mmc_free_host(mmc);
        }
 
        return 0;