From 4dd14a653910662ca31544a38b1553f10e96fbb2 Mon Sep 17 00:00:00 2001 From: Robby Cai Date: Wed, 2 Jul 2014 18:53:51 +0800 Subject: [PATCH] ENGR00320846 v4l2 capture: imx6sx: fix crash issue when rmmod csi_v4l2_capture The reproduce steps: modprobe fsl_csi modprobe csi_v4l2_capture modprobe ov5640_camera modprobe mxc_vadc_tvin rmmod mxc_vadc_tvin rmmod ov5640_camera rmmod csi_v4l2_capture The kernel dump info: V4L2 freeing image input device Unable to handle kernel NULL pointer dereference at virtual address 00000018 pgd = a8f38000 [00000018] *pgd=a8713831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM Modules linked in: csi_v4l2_capture(-) fsl_csi ov5642_camera evbug [last unloaded: ov5640_camera] CPU: 0 PID: 804 Comm: rmmod Not tainted 3.10.31-1.1.0_beta+g3c16fd0 #1 task: a8bfb2c0 ti: a8bc4000 task.ti: a8bc4000 PC is at csi_v4l2_remove+0x14/0x80 [csi_v4l2_capture] LR is at platform_drv_remove+0x18/0x1c The cause is that only one global variable used for two instances in remove() function. This patch changed the global variable to local one to fix it. Signed-off-by: Robby Cai --- drivers/media/platform/mxc/capture/csi_v4l2_capture.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/mxc/capture/csi_v4l2_capture.c b/drivers/media/platform/mxc/capture/csi_v4l2_capture.c index 3f759b635f8b62..542cbc790da33d 100644 --- a/drivers/media/platform/mxc/capture/csi_v4l2_capture.c +++ b/drivers/media/platform/mxc/capture/csi_v4l2_capture.c @@ -42,7 +42,6 @@ #include "fsl_csi.h" static int video_nr = -1; -static cam_data *g_cam; static int req_buf_number; static int csi_v4l2_master_attach(struct v4l2_int_device *slave); @@ -2184,6 +2183,7 @@ MODULE_DEVICE_TABLE(of, imx_csi_v4l2_dt_ids); static int csi_v4l2_probe(struct platform_device *pdev) { + static cam_data *g_cam; struct scatterlist *sg; u8 err = 0; @@ -2225,6 +2225,11 @@ static int csi_v4l2_probe(struct platform_device *pdev) static int csi_v4l2_remove(struct platform_device *pdev) { + cam_data *g_cam = platform_get_drvdata(pdev); + + if (g_cam == NULL) + return -EINVAL; + if (g_cam->open_count) { pr_err("ERROR: v4l2 capture:camera open " "-- setting ops to NULL\n");