From: lijian <lijian@xxxxxxxxxx> The 'data->pkt_tx_buff' is used after called ‘kfree(data->pkt_tx_buff)’,it may be null when it is called, and null pointer exception may occur, so judgment is added when using 'data->pkt_tx_buff'. Signed-off-by: lijian <lijian@xxxxxxxxxx> --- drivers/spi/spi-topcliff-pch.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c index b8870784fc6e..a5ac59f2eb80 100644 --- a/drivers/spi/spi-topcliff-pch.c +++ b/drivers/spi/spi-topcliff-pch.c @@ -599,7 +599,7 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw) } /* copy Tx Data */ - if (data->cur_trans->tx_buf != NULL) { + if ((data->cur_trans->tx_buf != NULL) && (data->pkt_tx_buff != NULL)) { if (*bpw == 8) { tx_buf = data->cur_trans->tx_buf; for (j = 0; j < data->bpw_len; j++) @@ -621,8 +621,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw) __func__); pch_spi_writereg(data->master, PCH_SSNXCR, SSN_LOW); - for (j = 0; j < n_writes; j++) - pch_spi_writereg(data->master, PCH_SPDWR, data->pkt_tx_buff[j]); + if (data->pkt_tx_buff != NULL) { + for (j = 0; j < n_writes; j++) + pch_spi_writereg(data->master, PCH_SPDWR, data->pkt_tx_buff[j]); + } /* update tx_index */ data->tx_index = j; -- 2.25.1