]> git.baikalelectronics.ru Git - uboot.git/commit
dm: spi: Fix spi_free_slave() freed memory write
authorNiel Fourie <lusus@denx.de>
Wed, 16 Dec 2020 11:11:52 +0000 (12:11 +0100)
committerSimon Glass <sjg@chromium.org>
Wed, 23 Dec 2020 03:39:26 +0000 (20:39 -0700)
commita10159c0aea42122acacd77602f276726c745f1c
tree6ee26516eab655106830acb48deb90bae4c9b664
parent6fd6b88a5061962bf8fc6d8458c3b121689c60b8
dm: spi: Fix spi_free_slave() freed memory write

Remove setting slave->dev to NULL after the device_remove() call.

The slave pointer points to dev->parent_priv, which has already
been freed by device_free(), called from device_remove() in the
preceding line. Writing to slave->dev may cause corruption of the
dlmalloc free chunk forward pointer of the previously freed chunk.

Signed-off-by: Niel Fourie <lusus@denx.de>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
drivers/spi/spi-uclass.c