dfu: dfu_sf: avoid double free of SPI device

Multiple DFU entities may share the same SPI device. We must make sure that
the SPI device is only freed once.

When using the driver model it is not necessary to free the SPI device.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Lukasz Majewski <lukma@denx.de>

diff --git a/drivers/dfu/dfu_sf.c b/drivers/dfu/dfu_sf.c
index 76b629a..8f8c425 100644 (file)
--- a/drivers/dfu/dfu_sf.c
+++ b/drivers/dfu/dfu_sf.c
@@ -87,7 +87,23 @@ static unsigned int dfu_polltimeout_sf(struct dfu_entity *dfu)
 
 static void dfu_free_entity_sf(struct dfu_entity *dfu)
 {
-       spi_flash_free(dfu->data.sf.dev);
+       /*
+        * In the DM case it is not necessary to free the SPI device.
+        * For the non-DM case we must ensure that the the SPI device is only
+        * freed once.
+        */
+       if (!CONFIG_IS_ENABLED(DM_SPI_FLASH)) {
+               struct spi_flash *dev = dfu->data.sf.dev;
+
+               if (!dev)
+                       return;
+               dfu->data.sf.dev = NULL;
+               list_for_each_entry(dfu, &dfu_list, list) {
+                       if (dfu->data.sf.dev == dev)
+                               dfu->data.sf.dev = NULL;
+               }
+               spi_flash_free(dev);
+       }
 }
 
 static struct spi_flash *parse_dev(char *devstr)