diff mbox

[213/237] spi: rspi: Add spi_master_get() call to prevent use after free

Message ID 1387000406-29111-214-git-send-email-horms+renesas@verge.net.au (mailing list archive)
State New, archived
Headers show

Commit Message

Simon Horman Dec. 14, 2013, 5:53 a.m. UTC 
From: Axel Lin <axel.lin@ingics.com>

In rspi_remove(), current code dereferences rspi after spi_unregister_master(),
thus add an extra spi_master_get() call is necessary to prevent use after free.

Current code already has an extra spi_master_put() call in rspi_remove(), so
this patch just adds a spi_master_get() call rather than a spi_master_get() with
spi_master_put() calls.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit 9d3405dbbbd8418a095301d495da65bc3bc5f806)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
---
 drivers/spi/spi-rspi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 00c3232..49ae72a 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -726,7 +726,7 @@  static void rspi_release_dma(struct rspi_data *rspi)
 
 static int rspi_remove(struct platform_device *pdev)
 {
-	struct rspi_data *rspi = platform_get_drvdata(pdev);
+	struct rspi_data *rspi = spi_master_get(platform_get_drvdata(pdev));
 
 	spi_unregister_master(rspi->master);
 	rspi_release_dma(rspi);