Calling spi_unregister_controller() during driver remove results in freeing the SPI controller and the associated driver data. Using it later in dspi_remove() is a use-after-free bug. Register the controller with devm_spi_register_controller() instead which makes calling spi_unregister_controller() unnecessary. Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> --- drivers/spi/spi-fsl-dspi.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c index 91c6affe139c..a6c100b89360 100644 --- a/drivers/spi/spi-fsl-dspi.c +++ b/drivers/spi/spi-fsl-dspi.c @@ -1416,7 +1416,7 @@ static int dspi_probe(struct platform_device *pdev) platform_set_drvdata(pdev, ctlr); - ret = spi_register_controller(ctlr); + ret = devm_spi_register_controller(&pdev->dev, ctlr); if (ret != 0) { dev_err(&pdev->dev, "Problem registering DSPI ctlr\n"); goto out_free_irq; @@ -1440,9 +1440,6 @@ static int dspi_remove(struct platform_device *pdev) struct spi_controller *ctlr = platform_get_drvdata(pdev); struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr); - /* Disconnect from the SPI framework */ - spi_unregister_controller(dspi->ctlr); - /* Disable RX and TX */ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF, -- 2.28.0