Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 350d0076 authored by Atsushi Nemoto's avatar Atsushi Nemoto Committed by Linus Torvalds
Browse files

spi: fix double-free on spi_unregister_master 



After 49dce689, device_for_each_child
iteration hits the master device itself.  Do not call spi_unregister_device()
for the master device.

Signed-off-by: default avatarAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Acked-by: default avatarDavid Brownell <david-b@pacbell.net>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent cbff2fbf

drivers/spi/spi.c

+5 −3
Original line number Original line Diff line number Diff line
@@ -457,9 +457,10 @@ int spi_register_master(struct spi_master *master) 
EXPORT_SYMBOL_GPL(spi_register_master);

EXPORT_SYMBOL_GPL(spi_register_master);









static int __unregister(struct device *dev, void *unused)

static int __unregister(struct device *dev, void *master_dev)

{

{

	/* note: before about 2.6.14-rc1 this would corrupt memory: */

	/* note: before about 2.6.14-rc1 this would corrupt memory: */

	if (dev != master_dev)

		spi_unregister_device(to_spi_device(dev));

		spi_unregister_device(to_spi_device(dev));

	return 0;

	return 0;

}

}
@@ -478,7 +479,8 @@ void spi_unregister_master(struct spi_master *master) 
{

{

	int dummy;

	int dummy;





	dummy = device_for_each_child(master->dev.parent, NULL, __unregister);

	dummy = device_for_each_child(master->dev.parent, &master->dev,

					__unregister);

	device_unregister(&master->dev);

	device_unregister(&master->dev);

}

}

EXPORT_SYMBOL_GPL(spi_unregister_master);

EXPORT_SYMBOL_GPL(spi_unregister_master);