[Linux-fbdev-devel] [PATCH] [drivers] [fb] S3C-fb: fix off-by-one bug in loop indexes

[Marek S. <m.s...@sa...>]

From: Pawel Osciak <p.o...@sa...>

Fixed off-by-one bug in loop indexes - some elements beyond windows' array were
accessed, which might result in memory access violations when removing/suspending
the device.

Signed-off-by: Pawel Osciak <p.o...@sa...>
Reviewed-by: Kyungmin Park <kyu...@sa...>
Signed-off-by: Marek Szyprowski <m.s...@sa...>


--- 

diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 094bfeb..92f2a59 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -970,7 +970,7 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
 	struct s3c_fb *sfb = platform_get_drvdata(pdev);
 	int win;
 
-	for (win = 0; win <= S3C_FB_MAX_WIN; win++)
+	for (win = 0; win < S3C_FB_MAX_WIN; win++)
 		if (sfb->windows[win])
 			s3c_fb_release_win(sfb, sfb->windows[win]);
 
@@ -994,7 +994,7 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
 	struct s3c_fb_win *win;
 	int win_no;
 
-	for (win_no = S3C_FB_MAX_WIN; win_no >= 0; win_no--) {
+	for (win_no = S3C_FB_MAX_WIN - 1; win_no >= 0; win_no--) {
 		win = sfb->windows[win_no];
 		if (!win)
 			continue;