Skip to content
Commit 7371944a authored by Boris Brezillon's avatar Boris Brezillon Committed by Jagan Teki
Browse files

mtd: sf: Unregister the MTD device prior to removing the spi_flash obj

The DM implementation of spi_flash_free() does not unregister the MTD
device before removing the spi dev object. This leads to a use-after-free
bug when the MTD device is later accessed by a MTD user (observed when
attaching the device to UBI after env_sf_load() has called
spi_flash_free()).

Implement ->remove() and call spi_flash_mtd_unregister() from there.

Fixes: 9fe6d871

 ("mtd, spi: Add MTD layer driver")
Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
Tested-by: default avatarHeiko Schocher <hs@denx.de>
Reviewed-by: default avatarJagan Teki <jagan@openedev.com>
parent 4a5594fa
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment