Calling spi_unregister_controller() during driver remove results in freeing the SPI controller and the associated driver data. Using it later in rpcif_spi_remove() is a use-after-free bug. Register the controller with devm_spi_register_controller() instead which makes calling spi_unregister_controller() unnecessary. Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> --- drivers/spi/spi-rpc-if.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c index ed3e548227f4..2140bb249796 100644 --- a/drivers/spi/spi-rpc-if.c +++ b/drivers/spi/spi-rpc-if.c @@ -156,7 +156,7 @@ static int rpcif_spi_probe(struct platform_device *pdev) rpcif_hw_init(rpc, false); - error = spi_register_controller(ctlr); + error = devm_spi_register_controller(&pdev->dev, ctlr); if (error) { dev_err(&pdev->dev, "spi_register_controller failed\n"); goto err_put_ctlr; @@ -175,7 +175,6 @@ static int rpcif_spi_remove(struct platform_device *pdev) struct spi_controller *ctlr = platform_get_drvdata(pdev); struct rpcif *rpc = spi_controller_get_devdata(ctlr); - spi_unregister_controller(ctlr); rpcif_disable_rpm(rpc); return 0; -- 2.28.0