mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
s3c-fb: fix off-by-one bug in loop indexes
Fixed off-by-one bug in loop indexes - some elements beyond windows' array were accessed, which might result in memory access violations when removing/suspending the device. Signed-off-by: Pawel Osciak <p.osciak@samsung.com> Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Krzysztof Helt <krzysztof.h1@poczta.fm> Cc: Ben Dooks <ben-linux@fluff.org> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
3d768213a6
commit
c42b110cae
1 changed files with 2 additions and 2 deletions
|
@ -964,7 +964,7 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
|
|||
struct s3c_fb *sfb = platform_get_drvdata(pdev);
|
||||
int win;
|
||||
|
||||
for (win = 0; win <= S3C_FB_MAX_WIN; win++)
|
||||
for (win = 0; win < S3C_FB_MAX_WIN; win++)
|
||||
if (sfb->windows[win])
|
||||
s3c_fb_release_win(sfb, sfb->windows[win]);
|
||||
|
||||
|
@ -988,7 +988,7 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
|
|||
struct s3c_fb_win *win;
|
||||
int win_no;
|
||||
|
||||
for (win_no = S3C_FB_MAX_WIN; win_no >= 0; win_no--) {
|
||||
for (win_no = S3C_FB_MAX_WIN - 1; win_no >= 0; win_no--) {
|
||||
win = sfb->windows[win_no];
|
||||
if (!win)
|
||||
continue;
|
||||
|
|
Loading…
Reference in a new issue