[PATCH 04/24] V4L2: fix Oops on rmmod path

[Guennadi Liakhovetski <g.liakhovetski@xxxxxx>]

v4l2_async_cleanup() clears the sd->dev pointer, avoid dereferencing it in
v4l2_async_unregister().

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@xxxxxx>
---
 drivers/media/v4l2-core/v4l2-async.c |   18 ++++++------------
 1 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 98db2e0..5d6b428 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -123,16 +123,6 @@ static void v4l2_async_cleanup(struct v4l2_async_subdev_list *asdl)
 	sd->dev = NULL;
 }
 
-static void v4l2_async_unregister(struct v4l2_async_subdev_list *asdl)
-{
-	struct v4l2_subdev *sd = v4l2_async_to_subdev(asdl);
-
-	v4l2_async_cleanup(asdl);
-
-	/* If we handled USB devices, we'd have to lock the parent too */
-	device_release_driver(sd->dev);
-}
-
 int v4l2_async_notifier_register(struct v4l2_device *v4l2_dev,
 				 struct v4l2_async_notifier *notifier)
 {
@@ -203,9 +193,13 @@ void v4l2_async_notifier_unregister(struct v4l2_async_notifier *notifier)
 	list_for_each_entry_safe(asdl, tmp, &notifier->done, list) {
 		if (dev) {
 			struct v4l2_subdev *sd = v4l2_async_to_subdev(asdl);
-			dev[i++] = get_device(sd->dev);
+			dev[i] = get_device(sd->dev);
 		}
-		v4l2_async_unregister(asdl);
+		v4l2_async_cleanup(asdl);
+
+		/* If we handled USB devices, we'd have to lock the parent too */
+		if (dev)
+			device_release_driver(dev[i++]);
 
 		if (notifier->unbind)
 			notifier->unbind(notifier, asdl);
-- 
1.7.2.5

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html