| From 2ad7467e4426003e04cf09f24e1f3f9dde374db9 Mon Sep 17 00:00:00 2001 |
| From: Axel Lin <axel.lin@ingics.com> |
| Date: Sat, 31 Aug 2013 19:42:56 +0800 |
| Subject: spi: rspi: Add spi_master_get() call to prevent use after free |
| |
| In rspi_remove(), current code dereferences rspi after spi_unregister_master(), |
| thus add an extra spi_master_get() call is necessary to prevent use after free. |
| |
| Current code already has an extra spi_master_put() call in rspi_remove(), so |
| this patch just adds a spi_master_get() call rather than a spi_master_get() with |
| spi_master_put() calls. |
| |
| Signed-off-by: Axel Lin <axel.lin@ingics.com> |
| Signed-off-by: Mark Brown <broonie@linaro.org> |
| (cherry picked from commit 9d3405dbbbd8418a095301d495da65bc3bc5f806) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| --- |
| drivers/spi/spi-rspi.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c |
| index 00c32320dce8..49ae72a93087 100644 |
| --- a/drivers/spi/spi-rspi.c |
| +++ b/drivers/spi/spi-rspi.c |
| @@ -726,7 +726,7 @@ static void rspi_release_dma(struct rspi_data *rspi) |
| |
| static int rspi_remove(struct platform_device *pdev) |
| { |
| - struct rspi_data *rspi = platform_get_drvdata(pdev); |
| + struct rspi_data *rspi = spi_master_get(platform_get_drvdata(pdev)); |
| |
| spi_unregister_master(rspi->master); |
| rspi_release_dma(rspi); |
| -- |
| 1.8.5.rc3 |
| |
