From ce31656b32220471cd57c34585d8fffa7756728b Mon Sep 17 00:00:00 2001 From: Shaoen-Lin Date: Mon, 1 Jun 2026 17:45:12 +0800 Subject: [PATCH] Fix device removal loop bounds The removal loop shifts vcam_devices entries left by reading vcam_devices[i + 1]. The current loop lets i reach vcam_device_count - 1, so the last iteration reads one entry past the valid array range. Stop the loop before i + 1 reaches vcam_device_count. Signed-off-by: Shaoen-Lin --- control.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/control.c b/control.c index 5d3ba3d..27cca9c 100644 --- a/control.c +++ b/control.c @@ -119,7 +119,7 @@ static int control_iocontrol_destroy_device(struct vcam_device_spec *dev_spec) spin_unlock_irqrestore(&dev->in_fh_slock, flags); spin_lock_irqsave(&ctldev->vcam_devices_lock, flags); - for (i = dev_spec->idx; i < (ctldev->vcam_device_count); i++) + for (i = dev_spec->idx; i + 1 < (ctldev->vcam_device_count); i++) ctldev->vcam_devices[i] = ctldev->vcam_devices[i + 1]; ctldev->vcam_devices[--ctldev->vcam_device_count] = NULL; spin_unlock_irqrestore(&ctldev->vcam_devices_lock, flags);