From c42b110caeb128819104d057acdaa1ae564b7c8d Mon Sep 17 00:00:00 2001
From: Pawel Osciak
Date: Wed, 29 Jul 2009 15:02:10 -0700
Subject: s3c-fb: fix off-by-one bug in loop indexes
Fixed off-by-one bug in loop indexes - some elements beyond windows' array
were accessed, which might result in memory access violations when
removing/suspending the device.
Signed-off-by: Pawel Osciak
Reviewed-by: Kyungmin Park
Signed-off-by: Marek Szyprowski
Cc: Krzysztof Helt
Cc: Ben Dooks
Cc: Russell King
Signed-off-by: Andrew Morton
Signed-off-by: Linus Torvalds
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index bb63c07..5a72083 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -964,7 +964,7 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
struct s3c_fb *sfb = platform_get_drvdata(pdev);
int win;
- for (win = 0; win <= S3C_FB_MAX_WIN; win++)
+ for (win = 0; win < S3C_FB_MAX_WIN; win++)
if (sfb->windows[win])
s3c_fb_release_win(sfb, sfb->windows[win]);
@@ -988,7 +988,7 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
struct s3c_fb_win *win;
int win_no;
- for (win_no = S3C_FB_MAX_WIN; win_no >= 0; win_no--) {
+ for (win_no = S3C_FB_MAX_WIN - 1; win_no >= 0; win_no--) {
win = sfb->windows[win_no];
if (!win)
continue;
--
cgit v0.10.2