Skip to content

Commit

Permalink
pcmcia: i82092: fix i82092aa_pci_remove()
Browse files Browse the repository at this point in the history
Smatch complains because the call to
	pci_set_drvdata(dev, &sockets[i].socket);
is reading one step beyond the end of the sockets[] array.  It will
crash when we use it later.

The only place which uses pci_get_drvdata() is i82092aa_pci_remove().
That function should loop through all the sockets and unregister them.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Jan 17, 2013
1 parent 7353f85 commit 36c286d
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions drivers/pcmcia/i82092.c
Original file line number Diff line number Diff line change
Expand Up @@ -133,8 +133,6 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i
goto err_out_free_res;
}

pci_set_drvdata(dev, &sockets[i].socket);

for (i = 0; i<socket_count; i++) {
sockets[i].socket.dev.parent = &dev->dev;
sockets[i].socket.ops = &i82092aa_operations;
Expand Down Expand Up @@ -164,14 +162,14 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i

static void i82092aa_pci_remove(struct pci_dev *dev)
{
struct pcmcia_socket *socket = pci_get_drvdata(dev);
int i;

enter("i82092aa_pci_remove");

free_irq(dev->irq, i82092aa_interrupt);

if (socket)
pcmcia_unregister_socket(socket);
for (i = 0; i < socket_count; i++)
pcmcia_unregister_socket(&sockets[i].socket);

leave("i82092aa_pci_remove");
}
Expand Down

0 comments on commit 36c286d

Please sign in to comment.