From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Date: Thu, 15 Nov 2007 00:59:22 +0000 (-0800)
Subject: spi: fix double-free on spi_unregister_master
X-Git-Tag: v2.6.24-rc3~102
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=350d0076c5763ca2b88ca05e3889bfa7c1905f21;p=~emulex%2Finfiniband.git

spi: fix double-free on spi_unregister_master

After 49dce689ad4ef0fd1f970ef762168e4bd46f69a3, device_for_each_child
iteration hits the master device itself.  Do not call spi_unregister_device()
for the master device.

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Acked-by: David Brownell <david-b@pacbell.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 89769ce16f8..b31f4431849 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -457,10 +457,11 @@ done:
 EXPORT_SYMBOL_GPL(spi_register_master);
 
 
-static int __unregister(struct device *dev, void *unused)
+static int __unregister(struct device *dev, void *master_dev)
 {
 	/* note: before about 2.6.14-rc1 this would corrupt memory: */
-	spi_unregister_device(to_spi_device(dev));
+	if (dev != master_dev)
+		spi_unregister_device(to_spi_device(dev));
 	return 0;
 }
 
@@ -478,7 +479,8 @@ void spi_unregister_master(struct spi_master *master)
 {
 	int dummy;
 
-	dummy = device_for_each_child(master->dev.parent, NULL, __unregister);
+	dummy = device_for_each_child(master->dev.parent, &master->dev,
+					__unregister);
 	device_unregister(&master->dev);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);