From patchwork Sat Aug 18 16:29:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 1341221 Return-Path: X-Original-To: patchwork-spi-devel-general@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by patchwork1.kernel.org (Postfix) with ESMTP id 24C4B3FD8C for ; Sat, 18 Aug 2012 16:29:46 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=sfs-ml-4.v29.ch3.sourceforge.com) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1T2luD-0000se-Rw; Sat, 18 Aug 2012 16:29:45 +0000 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1T2luC-0000sY-81 for spi-devel-general@lists.sourceforge.net; Sat, 18 Aug 2012 16:29:44 +0000 X-ACL-Warn: Received: from mail.active-venture.com ([67.228.131.205]) by sog-mx-3.v43.ch3.sourceforge.com with esmtp (Exim 4.76) id 1T2luB-0007TY-KE for spi-devel-general@lists.sourceforge.net; Sat, 18 Aug 2012 16:29:44 +0000 Received: (qmail 27348 invoked by uid 399); 18 Aug 2012 16:29:34 -0000 X-Virus-Scan: Scanned by ClamAV 0.97.2 (no viruses); Sat, 18 Aug 2012 11:29:34 -0500 Received: from unknown (HELO localhost) (guenter@roeck-us.net@108.223.40.66) by mail.active-venture.com with ESMTPAM; 18 Aug 2012 16:29:34 -0000 X-Originating-IP: 108.223.40.66 X-Sender: guenter@roeck-us.net From: Guenter Roeck To: spi-devel-general@lists.sourceforge.net Subject: [PATCH 4/4] spi/mpc512x-psc: Avoid access to freed memory in device remove function Date: Sat, 18 Aug 2012 09:29:24 -0700 Message-Id: <1345307364-4914-4-git-send-email-linux@roeck-us.net> X-Mailer: git-send-email 1.7.9.7 In-Reply-To: <1345307364-4914-1-git-send-email-linux@roeck-us.net> References: <1345307364-4914-1-git-send-email-linux@roeck-us.net> X-Spam-Score: 0.9 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT [67.228.131.205 listed in bb.barracudacentral.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.7 AWL AWL: From: address is in the auto white-list X-Headers-End: 1T2luB-0007TY-KE Cc: Mark Brown , Guenter Roeck X-BeenThere: spi-devel-general@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Linux SPI core/device drivers discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: spi-devel-general-bounces@lists.sourceforge.net The call to spi_unregister_master() in the device remove function frees device memory, and with it any device local data. However, device local data is still accessed after the call to spi_unregister_master(). Acquire a reference to the SPI master device and release it after cleanup is complete to solve the problem. Signed-off-by: Guenter Roeck --- drivers/spi/spi-mpc512x-psc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c index 4c63f77..0a1e39e 100644 --- a/drivers/spi/spi-mpc512x-psc.c +++ b/drivers/spi/spi-mpc512x-psc.c @@ -494,7 +494,7 @@ free_master: static int __devexit mpc512x_psc_spi_do_remove(struct device *dev) { - struct spi_master *master = dev_get_drvdata(dev); + struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); struct mpc512x_psc_spi *mps = spi_master_get_devdata(master); flush_workqueue(mps->workqueue); @@ -503,6 +503,7 @@ static int __devexit mpc512x_psc_spi_do_remove(struct device *dev) free_irq(mps->irq, mps); if (mps->psc) iounmap(mps->psc); + spi_master_put(master); return 0; }