spi/omap2_mcspi: Check params before dereference or use

Check spi->chip_select for range before use.

Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>

diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index 6df8553..b3a94ca 100644 (file)
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -834,7 +834,6 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
        struct omap2_mcspi_cs   *cs;
 
        mcspi = spi_master_get_devdata(spi->master);
-       mcspi_dma = &mcspi->dma_channels[spi->chip_select];
 
        if (spi->controller_state) {
                /* Unlink controller state from context save list */
@@ -844,13 +843,17 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
                kfree(spi->controller_state);
        }
 
-       if (mcspi_dma->dma_rx_channel != -1) {
-               omap_free_dma(mcspi_dma->dma_rx_channel);
-               mcspi_dma->dma_rx_channel = -1;
-       }
-       if (mcspi_dma->dma_tx_channel != -1) {
-               omap_free_dma(mcspi_dma->dma_tx_channel);
-               mcspi_dma->dma_tx_channel = -1;
+       if (spi->chip_select < spi->master->num_chipselect) {
+               mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+
+               if (mcspi_dma->dma_rx_channel != -1) {
+                       omap_free_dma(mcspi_dma->dma_rx_channel);
+                       mcspi_dma->dma_rx_channel = -1;
+               }
+               if (mcspi_dma->dma_tx_channel != -1) {
+                       omap_free_dma(mcspi_dma->dma_tx_channel);
+                       mcspi_dma->dma_tx_channel = -1;
+               }
        }
 }