staging: fsl-mc: Fix crash in fsl_mc_device_remove()

Only call fsl_mc_io_destroy() if the DPRC being removed
actually had an mc_io object associated with. Child DPRCs
that have not been bound to the DPRC driver or the VFIO driver
will not have an mc_io associated with them.

Signed-off-by: J. German Rivera <German.Rivera@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/fsl-mc/bus/dprc-driver.c b/drivers/staging/fsl-mc/bus/dprc-driver.c
index 9568eeac75b0654735bcd6aba0039c3f147bdf30..35c06cff1a06ff8f3bf46e23e668afbb4a5b944b 100644 (file)
--- a/drivers/staging/fsl-mc/bus/dprc-driver.c
+++ b/drivers/staging/fsl-mc/bus/dprc-driver.c
@@ -167,7 +167,6 @@ static void dprc_add_new_devices(struct fsl_mc_device *mc_bus_dev,
 
        for (i = 0; i < num_child_objects_in_mc; i++) {
                struct fsl_mc_device *child_dev;
-               struct fsl_mc_io *mc_io = NULL;
                struct dprc_obj_desc *obj_desc = &obj_desc_array[i];
 
                if (strlen(obj_desc->type) == 0)
@@ -182,14 +181,10 @@ static void dprc_add_new_devices(struct fsl_mc_device *mc_bus_dev,
                        continue;
                }
 
-               error = fsl_mc_device_add(obj_desc, mc_io, &mc_bus_dev->dev,
+               error = fsl_mc_device_add(obj_desc, NULL, &mc_bus_dev->dev,
                                          &child_dev);
-               if (error < 0) {
-                       if (mc_io)
-                               fsl_destroy_mc_io(mc_io);
-
+               if (error < 0)
                        continue;
-               }
        }
 }
 

diff --git a/drivers/staging/fsl-mc/bus/mc-bus.c b/drivers/staging/fsl-mc/bus/mc-bus.c
index de15fa9b4ba782f40d70aa8a209ce9319a9a4f9b..d943d99ba992b967d3a707253f76a9406319cb4c 100644 (file)
--- a/drivers/staging/fsl-mc/bus/mc-bus.c
+++ b/drivers/staging/fsl-mc/bus/mc-bus.c
@@ -444,15 +444,16 @@ void fsl_mc_device_remove(struct fsl_mc_device *mc_dev)
        put_device(&mc_dev->dev);
 
        if (strcmp(mc_dev->obj_desc.type, "dprc") == 0) {
-               struct fsl_mc_io *mc_io = mc_dev->mc_io;
-
                mc_bus = to_fsl_mc_bus(mc_dev);
-               fsl_destroy_mc_io(mc_io);
+               if (mc_dev->mc_io) {
+                       fsl_destroy_mc_io(mc_dev->mc_io);
+                       mc_dev->mc_io = NULL;
+               }
+
                if (&mc_dev->dev == fsl_mc_bus_type.dev_root)
                        fsl_mc_bus_type.dev_root = NULL;
        }
 
-       mc_dev->mc_io = NULL;
        if (mc_bus)
                devm_kfree(mc_dev->dev.parent, mc_bus);
        else