spi: sh-sci: fix use-after-free in sh_sci_spi_remove()

setbits() uses sp->membase. Signed-off-by: Jürg Billeter <j@bitron.ch> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Mark Brown <broonie@linaro.org>
git-mirror · Jun 17, 2014 · 25f8a7c · 25f8a7c
1 parent 7171511
commit 25f8a7c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
 {
 	struct sh_sci_spi *sp = platform_get_drvdata(dev);
 
-	iounmap(sp->membase);
-	setbits(sp, PIN_INIT, 0);
 	spi_bitbang_stop(&sp->bitbang);
+	setbits(sp, PIN_INIT, 0);
+	iounmap(sp->membase);
 	spi_master_put(sp->bitbang.master);
 	return 0;
 }