diff options
| author | Niel Fourie <lusus@denx.de> | 2020-12-16 12:11:52 +0100 |
|---|---|---|
| committer | Simon Glass <sjg@chromium.org> | 2020-12-22 20:39:26 -0700 |
| commit | fc314300ddbd60861b556318413662d6844a111d (patch) | |
| tree | 6ee26516eab655106830acb48deb90bae4c9b664 | |
| parent | a5624c6b4c42560e6072c114ce185c9a4bb3fde4 (diff) | |
| download | u-boot-fc314300ddbd60861b556318413662d6844a111d.tar.gz | |
dm: spi: Fix spi_free_slave() freed memory write
Remove setting slave->dev to NULL after the device_remove() call.
The slave pointer points to dev->parent_priv, which has already
been freed by device_free(), called from device_remove() in the
preceding line. Writing to slave->dev may cause corruption of the
dlmalloc free chunk forward pointer of the previously freed chunk.
Signed-off-by: Niel Fourie <lusus@denx.de>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
| -rw-r--r-- | drivers/spi/spi-uclass.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/spi/spi-uclass.c b/drivers/spi/spi-uclass.c index acef09d6f4..a392a93aa1 100644 --- a/drivers/spi/spi-uclass.c +++ b/drivers/spi/spi-uclass.c @@ -435,7 +435,6 @@ struct spi_slave *spi_setup_slave(unsigned int busnum, unsigned int cs, void spi_free_slave(struct spi_slave *slave) { device_remove(slave->dev, DM_REMOVE_NORMAL); - slave->dev = NULL; } int spi_slave_of_to_plat(struct udevice *dev, struct dm_spi_slave_plat *plat) |