Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36c286d5 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

pcmcia: i82092: fix i82092aa_pci_remove() 



Smatch complains because the call to
	pci_set_drvdata(dev, &sockets[i].socket);
is reading one step beyond the end of the sockets[] array.  It will
crash when we use it later.

The only place which uses pci_get_drvdata() is i82092aa_pci_remove().
That function should loop through all the sockets and unregister them.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7353f85c

drivers/pcmcia/i82092.c

+3 −5
Original line number Diff line number Diff line
@@ -133,8 +133,6 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i 
		goto err_out_free_res;

	}



	pci_set_drvdata(dev, &sockets[i].socket);



	for (i = 0; i<socket_count; i++) {

		sockets[i].socket.dev.parent = &dev->dev;

		sockets[i].socket.ops = &i82092aa_operations;
@@ -164,14 +162,14 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i 


static void i82092aa_pci_remove(struct pci_dev *dev)

{

	struct pcmcia_socket *socket = pci_get_drvdata(dev);

	int i;



	enter("i82092aa_pci_remove");

	

	free_irq(dev->irq, i82092aa_interrupt);



	if (socket)

		pcmcia_unregister_socket(socket);

	for (i = 0; i < socket_count; i++)

		pcmcia_unregister_socket(&sockets[i].socket);



	leave("i82092aa_pci_remove");

}