From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753898AbcAEUTw (ORCPT ); Tue, 5 Jan 2016 15:19:52 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:45244 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753492AbcAETsD (ORCPT ); Tue, 5 Jan 2016 14:48:03 -0500 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Ezequiel Garcia , Mauro Carvalho Chehab , Kamal Mostafa Subject: [PATCH 4.2.y-ckt 122/211] [media] vivid: Fix iteration in driver removal path Date: Tue, 5 Jan 2016 11:43:50 -0800 Message-Id: <1452023119-25647-123-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1452023119-25647-1-git-send-email-kamal@canonical.com> References: <1452023119-25647-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 4.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.2.8-ckt1 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Ezequiel Garcia commit a5d42b8c3b3ddccd88dc1c70957177d31a6699fb upstream. When the diver is removed and all the resources are deallocated, we should be iterating through the created devices only. Currently, the iteration ends when vivid_devs[i] is NULL. Since the array contains VIVID_MAX_DEVS elements, it will oops if n_devs=VIVID_MAX_DEVS because in that case, no element is NULL. Fixes: c88a96b023d8 ('[media] vivid: add core driver code') Signed-off-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Kamal Mostafa --- drivers/media/platform/vivid/vivid-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c index a047b47..0f5e914 100644 --- a/drivers/media/platform/vivid/vivid-core.c +++ b/drivers/media/platform/vivid/vivid-core.c @@ -1341,8 +1341,11 @@ static int vivid_remove(struct platform_device *pdev) struct vivid_dev *dev; unsigned i; - for (i = 0; vivid_devs[i]; i++) { + + for (i = 0; i < n_devs; i++) { dev = vivid_devs[i]; + if (!dev) + continue; if (dev->has_vid_cap) { v4l2_info(&dev->v4l2_dev, "unregistering %s\n", -- 1.9.1