Commit 7bc00310 authored Aug 22, 2013 by Axel Lin Committed by Mark Brown Aug 22, 2013

spi: bcm2835: Add spi_master_get() call to prevent use after free

The call to spi_unregister_master results in device memory being freed, it must
no longer be accessed afterwards. Thus call spi_master_get() to get an extra
reference to the device and call spi_master_put() only after the last access to
device data.

Note, current code has an extra spi_master_put() call in bcm2835_spi_remove().
Thus this patch just adds an spi_master_get() to balance the reference count.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

parent c2b6a3a8

drivers/spi/spi-bcm2835.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -377,7 +377,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)

	static int bcm2835_spi_remove(struct platform_device *pdev)		static int bcm2835_spi_remove(struct platform_device *pdev)
	{		{
	struct spi_master *master = platform_get_drvdata(pdev);		struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
	struct bcm2835_spi *bs = spi_master_get_devdata(master);		struct bcm2835_spi *bs = spi_master_get_devdata(master);

	free_irq(bs->irq, master);		free_irq(bs->irq, master);