diff options
| author | Jürg Billeter <j@bitron.ch> | 2014-06-16 18:39:29 +0400 |
|---|---|---|
| committer | Mark Brown <broonie@linaro.org> | 2014-06-17 18:47:31 +0400 |
| commit | 25f8a7cc5856f1c697c9aee88b0a898fcb6d788c (patch) | |
| tree | 1883b367e997b23322a55c770df761f470d2a1e0 /drivers | |
| parent | 7171511eaec5bf23fb06078f59784a3a0626b38f (diff) | |
| download | linux-25f8a7cc5856f1c697c9aee88b0a898fcb6d788c.tar.xz | |
spi: sh-sci: fix use-after-free in sh_sci_spi_remove()
setbits() uses sp->membase.
Signed-off-by: Jürg Billeter <j@bitron.ch>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/spi/spi-sh-sci.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c index 1f56ef651d1a..b83dd733684c 100644 --- a/drivers/spi/spi-sh-sci.c +++ b/drivers/spi/spi-sh-sci.c @@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev) { struct sh_sci_spi *sp = platform_get_drvdata(dev); - iounmap(sp->membase); - setbits(sp, PIN_INIT, 0); spi_bitbang_stop(&sp->bitbang); + setbits(sp, PIN_INIT, 0); + iounmap(sp->membase); spi_master_put(sp->bitbang.master); return 0; } |