A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

s3c-fb: fix off-by-one bug in loop indexes

Browse source 
Fixed off-by-one bug in loop indexes - some elements beyond windows' array
were accessed, which might result in memory access violations when
removing/suspending the device.

Signed-off-by: Pawel Osciak <[email protected]>
Reviewed-by: Kyungmin Park <[email protected]>
Signed-off-by: Marek Szyprowski <[email protected]>
Cc: Krzysztof Helt <[email protected]>
Cc: Ben Dooks <[email protected]>
Cc: Russell King <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Pawel Osciak 2009-07-29 15:02:10 -07:00 • committed by Linus Torvalds
commit c42b110cae
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/video/s3c-fb.c
View file

@ -964,7 +964,7 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
struct s3c_fb *sfb = platform_get_drvdata(pdev);
int win;
for (win = 0; win <= S3C_FB_MAX_WIN; win++)
for (win = 0; win < S3C_FB_MAX_WIN; win++)
if (sfb->windows[win])
s3c_fb_release_win(sfb, sfb->windows[win]);
@ -988,7 +988,7 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
struct s3c_fb_win *win;
int win_no;
for (win_no = S3C_FB_MAX_WIN; win_no >= 0; win_no--) {
for (win_no = S3C_FB_MAX_WIN - 1; win_no >= 0; win_no--) {
win = sfb->windows[win_no];
if (!win)
continue;