[PATCH] drivers/base/bus.c: fix iteration in driver_detach()

[Greg KH <gregkh@suse.de>]

[PATCH] drivers/base/bus.c: fix iteration in driver_detach()

With 2.6.11 and 2.6.12-rc2 (and perhaps a few versions before) usb
drivers for multi-interface devices, which do
usb_driver_release_interface() in their disconnect(), make rmmod hang.

It turns out to be due to a bug in drivers/base/bus.c:driver_detach(),
that iterates over the list of attached devices with
list_for_each_safe() under an assumption that device_release_driver()
only releases the current device, while it may also call
device_release_driver() for other devices on the same list.

The following patch fixes it.  Please consider applying.

Signed-off-by: Roman Kagan <rkagan@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
commit b2d84f078a8be40f5ae3b4d2ac001e2a7f45fe4f
tree 173f941991f1b68da820e9926a3b7ebdd3a2c8b9
parent 177a4324944478f2799ce4ede2797cb0f602f274
author Roman Kagan <rkagan@mail.ru> 1113414017 +0400
committer Greg KH <gregkh@suse.de> 1115275478 -0700

Index: drivers/base/bus.c
===================================================================
--- cc42dcdbce1c3b53ea147abd3ebf784f0d2bf1bc/drivers/base/bus.c  (mode:100644 sha1:f4fa27315fb4b69841ecf2a551d58d9a241c5546)
+++ 173f941991f1b68da820e9926a3b7ebdd3a2c8b9/drivers/base/bus.c  (mode:100644 sha1:2b3902c867dab76cf5b9b9d65d1778be20ac20e1)
@@ -405,9 +405,8 @@
 
 static void driver_detach(struct device_driver * drv)
 {
-	struct list_head * entry, * next;
-	list_for_each_safe(entry, next, &drv->devices) {
-		struct device * dev = container_of(entry, struct device, driver_list);
+	while (!list_empty(&drv->devices)) {
+		struct device * dev = container_of(drv->devices.next, struct device, driver_list);
 		device_release_driver(dev);
 	}
 }

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/