On Tue, 2020-09-22 at 11:32 +0200, Sascha Hauer wrote:
> Calling spi_unregister_controller() during driver remove results in
> freeing the SPI controller and the associated driver data. Using it
> later in bcm2835_spi_remove() is a use-after-free bug. Register the
> controller with devm_spi_register_controller() instead which makes
> calling spi_unregister_controller() unnecessary.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---

Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>

>  drivers/spi/spi-bcm2835.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
> index c45d76c848c8..d22103f7beeb 100644
> --- a/drivers/spi/spi-bcm2835.c
> +++ b/drivers/spi/spi-bcm2835.c
> @@ -1350,7 +1350,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
>  		goto out_dma_release;
>  	}
>  
> -	err = spi_register_controller(ctlr);
> +	err = devm_spi_register_controller(&pdev->dev, ctlr);
>  	if (err) {
>  		dev_err(&pdev->dev, "could not register SPI controller: %d\n",
>  			err);
> @@ -1377,8 +1377,6 @@ static int bcm2835_spi_remove(struct platform_device *pdev)
>  
>  	bcm2835_debugfs_remove(bs);
>  
> -	spi_unregister_controller(ctlr);
> -
>  	bcm2835_dma_release(ctlr, bs);
>  
>  	/* Clear FIFOs, and disable the HW block */