dm: spi: Fix spi_free_slave() freed memory write
authorNiel Fourie <lusus@denx.de>
Wed, 16 Dec 2020 11:11:52 +0000 (12:11 +0100)
committerSimon Glass <sjg@chromium.org>
Wed, 23 Dec 2020 03:39:26 +0000 (20:39 -0700)
commitfc314300ddbd60861b556318413662d6844a111d
tree6ee26516eab655106830acb48deb90bae4c9b664
parenta5624c6b4c42560e6072c114ce185c9a4bb3fde4
dm: spi: Fix spi_free_slave() freed memory write

Remove setting slave->dev to NULL after the device_remove() call.

The slave pointer points to dev->parent_priv, which has already
been freed by device_free(), called from device_remove() in the
preceding line. Writing to slave->dev may cause corruption of the
dlmalloc free chunk forward pointer of the previously freed chunk.

Signed-off-by: Niel Fourie <lusus@denx.de>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
drivers/spi/spi-uclass.c