ENGR00320846 v4l2 capture: imx6sx: fix crash issue when rmmod csi_v4l2_capture

The reproduce steps:
modprobe fsl_csi
modprobe csi_v4l2_capture
modprobe ov5640_camera
modprobe mxc_vadc_tvin
rmmod mxc_vadc_tvin
rmmod ov5640_camera
rmmod csi_v4l2_capture

The kernel dump info:
V4L2 freeing image input device
Unable to handle kernel NULL pointer dereference at virtual address 00000018
pgd = a8f38000
[00000018] *pgd=a8713831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in: csi_v4l2_capture(-) fsl_csi ov5642_camera evbug [last unloaded: ov5640_camera]
CPU: 0 PID: 804 Comm: rmmod Not tainted 3.10.31-1.1.0_beta+g3c16fd0 #1
task: a8bfb2c0 ti: a8bc4000 task.ti: a8bc4000
PC is at csi_v4l2_remove+0x14/0x80 [csi_v4l2_capture]
LR is at platform_drv_remove+0x18/0x1c

The cause is that only one global variable used for two instances in remove()
function.  This patch changed the global variable to local one to fix it.

Signed-off-by: Robby Cai <r63905@freescale.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/drivers/media/platform/mxc/capture/csi_v4l2_capture.c b/drivers/media/platform/mxc/capture/csi_v4l2_capture.c
index 3f759b635f8b..542cbc790da3 100644
--- a/drivers/media/platform/mxc/capture/csi_v4l2_capture.c
+++ b/drivers/media/platform/mxc/capture/csi_v4l2_capture.c
@@ -42,7 +42,6 @@
 #include "fsl_csi.h"
 
 static int video_nr = -1;
-static cam_data *g_cam;
 static int req_buf_number;
 
 static int csi_v4l2_master_attach(struct v4l2_int_device *slave);
@@ -2184,6 +2183,7 @@ MODULE_DEVICE_TABLE(of, imx_csi_v4l2_dt_ids);
 
 static int csi_v4l2_probe(struct platform_device *pdev)
 {
+        static cam_data *g_cam;
         struct scatterlist *sg;
         u8 err = 0;
 
@@ -2225,6 +2225,11 @@ out:
 
 static int csi_v4l2_remove(struct platform_device *pdev)
 {
+        cam_data *g_cam = platform_get_drvdata(pdev);
+
+        if (g_cam == NULL)
+                return -EINVAL;
+
         if (g_cam->open_count) {
                 pr_err("ERROR: v4l2 capture:camera open "
                        "-- setting ops to NULL\n");