From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41749 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753423AbcBNWiz (ORCPT ); Sun, 14 Feb 2016 17:38:55 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ezequiel Garcia , Mauro Carvalho Chehab Subject: [PATCH 4.3 086/200] [media] vivid: Fix iteration in driver removal path Date: Sun, 14 Feb 2016 14:21:33 -0800 Message-Id: <20160214222220.436495967@linuxfoundation.org> In-Reply-To: <20160214222217.084543173@linuxfoundation.org> References: <20160214222217.084543173@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: stable-owner@vger.kernel.org List-ID: 4.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ezequiel Garcia commit a5d42b8c3b3ddccd88dc1c70957177d31a6699fb upstream. When the diver is removed and all the resources are deallocated, we should be iterating through the created devices only. Currently, the iteration ends when vivid_devs[i] is NULL. Since the array contains VIVID_MAX_DEVS elements, it will oops if n_devs=VIVID_MAX_DEVS because in that case, no element is NULL. Fixes: c88a96b023d8 ('[media] vivid: add core driver code') Signed-off-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/platform/vivid/vivid-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/media/platform/vivid/vivid-core.c +++ b/drivers/media/platform/vivid/vivid-core.c @@ -1341,8 +1341,11 @@ static int vivid_remove(struct platform_ struct vivid_dev *dev; unsigned i; - for (i = 0; vivid_devs[i]; i++) { + + for (i = 0; i < n_devs; i++) { dev = vivid_devs[i]; + if (!dev) + continue; if (dev->has_vid_cap) { v4l2_info(&dev->v4l2_dev, "unregistering %s\n",