diff options
| author | Guenter Roeck <linux@roeck-us.net> | 2012-08-18 09:29:23 -0700 |
|---|---|---|
| committer | Mark Brown <broonie@opensource.wolfsonmicro.com> | 2012-08-22 19:26:36 +0100 |
| commit | c8c87c656f95d764eb2b460b46b0144794108da4 (patch) | |
| tree | eb464c0c2333ca38cd04a2ca00bc2ca3c78836d0 /drivers/spi/spi-mpc52xx-psc.c | |
| parent | f95e1028e3317a084af955aa0b1c25a6c9213869 (diff) | |
spi/mpc52xx-psc: Avoid access to freed memory in device remove function
The call to spi_unregister_master() in the device remove function frees device
memory, and with it any device local data. However, device local data is still
accessed after the call to spi_unregister_master().
Acquire a reference to the SPI master device and release it after cleanup is
complete to solve the problem.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Diffstat (limited to 'drivers/spi/spi-mpc52xx-psc.c')
| -rw-r--r-- | drivers/spi/spi-mpc52xx-psc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/spi/spi-mpc52xx-psc.c b/drivers/spi/spi-mpc52xx-psc.c index 66047156d90..bd47d262d53 100644 --- a/drivers/spi/spi-mpc52xx-psc.c +++ b/drivers/spi/spi-mpc52xx-psc.c @@ -481,7 +481,7 @@ static int __devinit mpc52xx_psc_spi_of_probe(struct platform_device *op) static int __devexit mpc52xx_psc_spi_of_remove(struct platform_device *op) { - struct spi_master *master = dev_get_drvdata(&op->dev); + struct spi_master *master = spi_master_get(dev_get_drvdata(&op->dev)); struct mpc52xx_psc_spi *mps = spi_master_get_devdata(master); flush_workqueue(mps->workqueue); @@ -490,6 +490,7 @@ static int __devexit mpc52xx_psc_spi_of_remove(struct platform_device *op) free_irq(mps->irq, mps); if (mps->psc) iounmap(mps->psc); + spi_master_put(master); return 0; } |