leandrof/u-boot
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dm: spi: Fix spi_free_slave() freed memory write

Browse Source 
Remove setting slave->dev to NULL after the device_remove() call.

The slave pointer points to dev->parent_priv, which has already
been freed by device_free(), called from device_remove() in the
preceding line. Writing to slave->dev may cause corruption of the
dlmalloc free chunk forward pointer of the previously freed chunk.

Signed-off-by: Niel Fourie <lusus@denx.de>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Niel Fourie 2020-12-16 12:11:52 +01:00 committed by Simon Glass
parent a5624c6b4c
commit fc314300dd
1 changed files with 0 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/spi/spi-uclass.c
View File

@ -435,7 +435,6 @@ struct spi_slave *spi_setup_slave(unsigned int busnum, unsigned int cs,
void spi_free_slave(struct spi_slave *slave) void spi_free_slave(struct spi_slave *slave)
{ {
device_remove(slave->dev, DM_REMOVE_NORMAL); device_remove(slave->dev, DM_REMOVE_NORMAL);
slave->dev = NULL;
} }
int spi_slave_of_to_plat(struct udevice *dev, struct dm_spi_slave_plat *plat) int spi_slave_of_to_plat(struct udevice *dev, struct dm_spi_slave_plat *plat)