From 25f8a7cc5856f1c697c9aee88b0a898fcb6d788c Mon Sep 17 00:00:00 2001
From: =?utf8?q?J=C3=BCrg=20Billeter?= <j@bitron.ch>
Date: Mon, 16 Jun 2014 16:39:29 +0200
Subject: [PATCH] spi: sh-sci: fix use-after-free in sh_sci_spi_remove()
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

setbits() uses sp->membase.

Signed-off-by: Jürg Billeter <j@bitron.ch>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
---
 drivers/spi/spi-sh-sci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 1f56ef651d1a..b83dd733684c 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
 {
 	struct sh_sci_spi *sp = platform_get_drvdata(dev);
 
-	iounmap(sp->membase);
-	setbits(sp, PIN_INIT, 0);
 	spi_bitbang_stop(&sp->bitbang);
+	setbits(sp, PIN_INIT, 0);
+	iounmap(sp->membase);
 	spi_master_put(sp->bitbang.master);
 	return 0;
 }
-- 
2.34.1