v4l2_async_cleanup() clears the sd->dev pointer, avoid dereferencing it in
v4l2_async_unregister().

Signed-off-by: Guennadi Liakhovetski <g.liakhovet...@gmx.de>
---
 drivers/media/v4l2-core/v4l2-async.c |   18 ++++++------------
 1 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-async.c 
b/drivers/media/v4l2-core/v4l2-async.c
index 98db2e0..5d6b428 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -123,16 +123,6 @@ static void v4l2_async_cleanup(struct 
v4l2_async_subdev_list *asdl)
        sd->dev = NULL;
 }
 
-static void v4l2_async_unregister(struct v4l2_async_subdev_list *asdl)
-{
-       struct v4l2_subdev *sd = v4l2_async_to_subdev(asdl);
-
-       v4l2_async_cleanup(asdl);
-
-       /* If we handled USB devices, we'd have to lock the parent too */
-       device_release_driver(sd->dev);
-}
-
 int v4l2_async_notifier_register(struct v4l2_device *v4l2_dev,
                                 struct v4l2_async_notifier *notifier)
 {
@@ -203,9 +193,13 @@ void v4l2_async_notifier_unregister(struct 
v4l2_async_notifier *notifier)
        list_for_each_entry_safe(asdl, tmp, &notifier->done, list) {
                if (dev) {
                        struct v4l2_subdev *sd = v4l2_async_to_subdev(asdl);
-                       dev[i++] = get_device(sd->dev);
+                       dev[i] = get_device(sd->dev);
                }
-               v4l2_async_unregister(asdl);
+               v4l2_async_cleanup(asdl);
+
+               /* If we handled USB devices, we'd have to lock the parent too 
*/
+               if (dev)
+                       device_release_driver(dev[i++]);
 
                if (notifier->unbind)
                        notifier->unbind(notifier, asdl);
-- 
1.7.2.5

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to