dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

spi/stmp: Fix device remove function 

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which results in
device memory being freed. The remove function accesses the freed memory after
the call to spi_unregister_master(), _and_ it calls spi_master_put on the freed
memory.

Acquire a reference to the SPI master device and release it after cleanup is
complete (with the existing spi_master_put) to solve the problem.

Also, the device subsystem ensures that the remove function is only called once,
and resets device driver data to NULL. Remove the respective check and drop the
unnecessaary call to platform_set_drvdata().

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
This commit is contained in:
Guenter Roeck 2012-08-23 20:08:47 -07:00 committed by Mark Brown
parent 58ed90de3e
commit 154390dcf8
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/spi/spi-stmp.c
View File

@ -594,9 +594,7 @@ static int __devexit stmp_spi_remove(struct platform_device *dev)
struct stmp_spi *ss;
struct spi_master *master;
master = platform_get_drvdata(dev);
if (master == NULL)
goto out0;
master = spi_master_get(platform_get_drvdata(dev));
ss = spi_master_get_devdata(master);
spi_unregister_master(master);
@ -609,8 +607,6 @@ static int __devexit stmp_spi_remove(struct platform_device *dev)
destroy_workqueue(ss->workqueue);
iounmap(ss->regs);
spi_master_put(master);
platform_set_drvdata(dev, NULL);
out0:
return 0;
}