Calling spi_unregister_controller() during driver remove results in freeing the SPI controller and the associated driver data. Using it later in bcm2835_spi_remove() is a use-after-free bug. Register the controller with devm_spi_register_controller() instead which makes calling spi_unregister_controller() unnecessary. Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> --- drivers/spi/spi-bcm2835.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c index c45d76c848c8..d22103f7beeb 100644 --- a/drivers/spi/spi-bcm2835.c +++ b/drivers/spi/spi-bcm2835.c @@ -1350,7 +1350,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) goto out_dma_release; } - err = spi_register_controller(ctlr); + err = devm_spi_register_controller(&pdev->dev, ctlr); if (err) { dev_err(&pdev->dev, "could not register SPI controller: %d\n", err); @@ -1377,8 +1377,6 @@ static int bcm2835_spi_remove(struct platform_device *pdev) bcm2835_debugfs_remove(bs); - spi_unregister_controller(ctlr); - bcm2835_dma_release(ctlr, bs); /* Clear FIFOs, and disable the HW block */ -- 2.28.0