From 7bc003100b61cdfe0515fe907010fe822353d924 Mon Sep 17 00:00:00 2001 From: Axel Lin Date: Thu, 22 Aug 2013 23:19:07 +0800 Subject: [PATCH] spi: bcm2835: Add spi_master_get() call to prevent use after free The call to spi_unregister_master results in device memory being freed, it must no longer be accessed afterwards. Thus call spi_master_get() to get an extra reference to the device and call spi_master_put() only after the last access to device data. Note, current code has an extra spi_master_put() call in bcm2835_spi_remove(). Thus this patch just adds an spi_master_get() to balance the reference count. Signed-off-by: Axel Lin Signed-off-by: Mark Brown --- drivers/spi/spi-bcm2835.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c index 7de617aba695..52c81481c5c7 100644 --- a/drivers/spi/spi-bcm2835.c +++ b/drivers/spi/spi-bcm2835.c @@ -377,7 +377,7 @@ out_master_put: static int bcm2835_spi_remove(struct platform_device *pdev) { - struct spi_master *master = platform_get_drvdata(pdev); + struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); struct bcm2835_spi *bs = spi_master_get_devdata(master); free_irq(bs->irq, master); -- 2.20.1