peak_pci: device channels chained list issue

[Grosjean Stephane <s.grosjean@peak-system.com>]

Hi Wolfgang,

I think the way the device channels are chained in peak_pci_probe() is 
buggy in the linux-can-next driver, and will lead to some Kernel Oops if 
the sja1000 module is removed. I fixed it by handling that list in the 
same manner than I handle channels in the PCAN-USB Pro adapter. Side 
effect is that the channels net devices are removed from the last to the 
first one...

Please have a look to the following patch.

Regards,

Stéphane

diff --git a/drivers/net/can/sja1000/peak_pci.c 
b/drivers/net/can/sja1000/peak_pci.c
index 2c7f503..7b5a4ab 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -40,7 +40,7 @@ MODULE_LICENSE("GPL v2");

  struct peak_pci_chan {
      void __iomem *cfg_base;         /* Common for all channels */
-    struct net_device *next_dev; /* Chain of network devices */
+    struct net_device *prev_dev; /* Chain of network devices */
      u16 icr_mask;             /* Interrupt mask for fast ack */
  };

@@ -98,7 +98,7 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
  {
      struct sja1000_priv *priv;
      struct peak_pci_chan *chan;
-    struct net_device *dev, *dev0 = NULL;
+    struct net_device *dev, *prev_dev;
      void __iomem *cfg_base, *reg_base;
      u16 sub_sys_id, icr;
      int i, err, channels;
@@ -196,18 +196,16 @@ static int __devinit peak_pci_probe(struct pci_dev 
*pdev,
          }

          /* Create chain of SJA1000 devices */
-        if (i == 0)
-            dev0 = dev;
-        else
-            chan->next_dev = dev;
+        prev_dev = pci_get_drvdata(pdev);
+        if (prev_dev)
+            chan->prev_dev = prev_dev;
+        pci_set_drvdata(pdev, dev);

          dev_info(&pdev->dev,
               "%s at reg_base=0x%p cfg_base=0x%p irq=%d\n",
               dev->name, priv->reg_base, chan->cfg_base, dev->irq);
      }

-    pci_set_drvdata(pdev, dev0);
-
      /* Enable interrupts */
      writew(icr, cfg_base + PITA_ICR + 2);

@@ -217,12 +215,12 @@ failure_remove_channels:
      /* Disable interrupts */
      writew(0x0, cfg_base + PITA_ICR + 2);

-    for (dev = dev0; dev; dev = chan->next_dev) {
+    for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
          unregister_sja1000dev(dev);
          free_sja1000dev(dev);
          priv = netdev_priv(dev);
          chan = priv->priv;
-        dev = chan->next_dev;
+        dev = chan->prev_dev;
      }

      pci_iounmap(pdev, reg_base);
@@ -241,7 +239,7 @@ failure_disable_pci:

  static void __devexit peak_pci_remove(struct pci_dev *pdev)
  {
-    struct net_device *dev = pci_get_drvdata(pdev); /* First device */
+    struct net_device *dev = pci_get_drvdata(pdev); /* Last device */
      struct sja1000_priv *priv = netdev_priv(dev);
      struct peak_pci_chan *chan = priv->priv;
      void __iomem *cfg_base = chan->cfg_base;
@@ -255,7 +253,7 @@ static void __devexit peak_pci_remove(struct pci_dev 
*pdev)
          dev_info(&pdev->dev, "removing device %s\n", dev->name);
          unregister_sja1000dev(dev);
          free_sja1000dev(dev);
-        dev = chan->next_dev;
+        dev = chan->prev_dev;
          if (!dev)
              break;
          priv = netdev_priv(dev);