Skip to contentSkip to conversation

pcmcia: i82092: fix i82092aa_pci_remove()

PATCH New Dan Carpenter 1 participant 1 message Dec 14, 2012

Subsystems (2)
Kernel janitors Pcmcia
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 pcmcia: i82092: fix i82092aa_pci_remove()

Smatch complains because the call to

	pci_set_drvdata(dev, &sockets[i].socket);

is reading one step beyond the end of the sockets[] array. It will crash when we use it later.

The only place which uses pci_get_drvdata() is i82092aa_pci_remove(). That function should loop through all the sockets and unregister them.

Signed-off-by Dan Carpenter <[email protected]>
drivers/pcmcia/i82092.c +3 -5
index 3578e1c..519c4d6 100644
@@ -133,8 +133,6 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i
 		goto err_out_free_res;
 	}
 
-	pci_set_drvdata(dev, &sockets[i].socket);
-
 	for (i = 0; i<socket_count; i++) {
 		sockets[i].socket.dev.parent = &dev->dev;
 		sockets[i].socket.ops = &i82092aa_operations;

@@ -164,14 +162,14 @@ err_out_disable:
 
 static void i82092aa_pci_remove(struct pci_dev *dev)
 {
-	struct pcmcia_socket *socket = pci_get_drvdata(dev);
+	int i;
 
 	enter("i82092aa_pci_remove");
 	
 	free_irq(dev->irq, i82092aa_interrupt);
 
-	if (socket)
-		pcmcia_unregister_socket(socket);
+	for (i = 0; i < socket_count; i++)
+		pcmcia_unregister_socket(&sockets[i].socket);
 
 	leave("i82092aa_pci_remove");
 }