From patchwork Sat Aug 18 16:29:23 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 1341201 Return-Path: X-Original-To: patchwork-spi-devel-general@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by patchwork2.kernel.org (Postfix) with ESMTP id 692D4DF266 for ; Sat, 18 Aug 2012 16:29:41 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1T2lu9-0003wk-5A; Sat, 18 Aug 2012 16:29:41 +0000 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1T2lu7-0003we-5G for spi-devel-general@lists.sourceforge.net; Sat, 18 Aug 2012 16:29:39 +0000 X-ACL-Warn: Received: from mail.active-venture.com ([67.228.131.205]) by sog-mx-3.v43.ch3.sourceforge.com with esmtp (Exim 4.76) id 1T2lu6-0007SZ-GS for spi-devel-general@lists.sourceforge.net; Sat, 18 Aug 2012 16:29:39 +0000 Received: (qmail 27315 invoked by uid 399); 18 Aug 2012 16:29:33 -0000 X-Virus-Scan: Scanned by ClamAV 0.97.2 (no viruses); Sat, 18 Aug 2012 11:29:33 -0500 Received: from unknown (HELO localhost) (guenter@roeck-us.net@108.223.40.66) by mail.active-venture.com with ESMTPAM; 18 Aug 2012 16:29:33 -0000 X-Originating-IP: 108.223.40.66 X-Sender: guenter@roeck-us.net From: Guenter Roeck To: spi-devel-general@lists.sourceforge.net Subject: [PATCH 3/4] spi/mpc52xx-psc: Avoid access to freed memory in device remove function Date: Sat, 18 Aug 2012 09:29:23 -0700 Message-Id: <1345307364-4914-3-git-send-email-linux@roeck-us.net> X-Mailer: git-send-email 1.7.9.7 In-Reply-To: <1345307364-4914-1-git-send-email-linux@roeck-us.net> References: <1345307364-4914-1-git-send-email-linux@roeck-us.net> X-Spam-Score: 0.9 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT [67.228.131.205 listed in bb.barracudacentral.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.8 AWL AWL: From: address is in the auto white-list X-Headers-End: 1T2lu6-0007SZ-GS Cc: Mark Brown , Guenter Roeck X-BeenThere: spi-devel-general@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Linux SPI core/device drivers discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: spi-devel-general-bounces@lists.sourceforge.net The call to spi_unregister_master() in the device remove function frees device memory, and with it any device local data. However, device local data is still accessed after the call to spi_unregister_master(). Acquire a reference to the SPI master device and release it after cleanup is complete to solve the problem. Signed-off-by: Guenter Roeck --- drivers/spi/spi-mpc52xx-psc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-mpc52xx-psc.c b/drivers/spi/spi-mpc52xx-psc.c index 6604715..bd47d26 100644 --- a/drivers/spi/spi-mpc52xx-psc.c +++ b/drivers/spi/spi-mpc52xx-psc.c @@ -481,7 +481,7 @@ static int __devinit mpc52xx_psc_spi_of_probe(struct platform_device *op) static int __devexit mpc52xx_psc_spi_of_remove(struct platform_device *op) { - struct spi_master *master = dev_get_drvdata(&op->dev); + struct spi_master *master = spi_master_get(dev_get_drvdata(&op->dev)); struct mpc52xx_psc_spi *mps = spi_master_get_devdata(master); flush_workqueue(mps->workqueue); @@ -490,6 +490,7 @@ static int __devexit mpc52xx_psc_spi_of_remove(struct platform_device *op) free_irq(mps->irq, mps); if (mps->psc) iounmap(mps->psc); + spi_master_put(master); return 0; }