[GIT PATCH] driver core bugfixes for 2.6.12-rc3

[GIT PATCH] driver core bugfixes for 2.6.12-rc3

[Greg KH]

Here are two driver core bugfixes for 2.6.12-rc3.

Pull from:
	rsync://rsync.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-2.6.git/

Full patches will be sent to the linux-kernel mailing lists, if anyone
wants to see them.

thanks,

greg k-h

-------------

 drivers/base/bus.c  |    5 ++---
 drivers/base/core.c |    2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

Alexander Nyberg:
  o Hotplug: Make dev->bus checking consistent

Roman Kagan:
  o drivers/base/bus.c: fix iteration in driver_detach()

[PATCH] Hotplug: Make dev->bus checking consistent

[Greg KH]

[PATCH] Hotplug: Make dev->bus checking consistent

Earlier in the same function dev->bus is checked before dereferenced,
make consistent although I honestly don't know if dev->bus could
ever be NULL

Found by the Coverity tool

Signed-off-by: Alexander Nyberg <alexn@dsv.su.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
commit 177a4324944478f2799ce4ede2797cb0f602f274
tree cc42dcdbce1c3b53ea147abd3ebf784f0d2bf1bc
parent 897f5ab2cd733a77a2279268262919caa8154b9d
author Alexander Nyberg <alexn@dsv.su.se> 1109421531 +0100
committer Greg KH <gregkh@suse.de> 1115275477 -0700

Index: drivers/base/core.c
===================================================================
--- 95866d31faa6db4ec786399296238344c7cfea0c/drivers/base/core.c  (mode:100644 sha1:a7cedd8cefe5385a8d2eb6f334c8661454c443d7)
+++ cc42dcdbce1c3b53ea147abd3ebf784f0d2bf1bc/drivers/base/core.c  (mode:100644 sha1:268a9c8d168b6ac72a46e0c624830b030b79df51)
@@ -139,7 +139,7 @@
 	buffer = &buffer[length];
 	buffer_size -= length;
 
-	if (dev->bus->hotplug) {
+	if (dev->bus && dev->bus->hotplug) {
 		/* have the bus specific function add its stuff */
 		retval = dev->bus->hotplug (dev, envp, num_envp, buffer, buffer_size);
 			if (retval) {

[PATCH] drivers/base/bus.c: fix iteration in driver_detach()

[Greg KH]

[PATCH] drivers/base/bus.c: fix iteration in driver_detach()

With 2.6.11 and 2.6.12-rc2 (and perhaps a few versions before) usb
drivers for multi-interface devices, which do
usb_driver_release_interface() in their disconnect(), make rmmod hang.

It turns out to be due to a bug in drivers/base/bus.c:driver_detach(),
that iterates over the list of attached devices with
list_for_each_safe() under an assumption that device_release_driver()
only releases the current device, while it may also call
device_release_driver() for other devices on the same list.

The following patch fixes it.  Please consider applying.

Signed-off-by: Roman Kagan <rkagan@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
commit b2d84f078a8be40f5ae3b4d2ac001e2a7f45fe4f
tree 173f941991f1b68da820e9926a3b7ebdd3a2c8b9
parent 177a4324944478f2799ce4ede2797cb0f602f274
author Roman Kagan <rkagan@mail.ru> 1113414017 +0400
committer Greg KH <gregkh@suse.de> 1115275478 -0700

Index: drivers/base/bus.c
===================================================================
--- cc42dcdbce1c3b53ea147abd3ebf784f0d2bf1bc/drivers/base/bus.c  (mode:100644 sha1:f4fa27315fb4b69841ecf2a551d58d9a241c5546)
+++ 173f941991f1b68da820e9926a3b7ebdd3a2c8b9/drivers/base/bus.c  (mode:100644 sha1:2b3902c867dab76cf5b9b9d65d1778be20ac20e1)
@@ -405,9 +405,8 @@
 
 static void driver_detach(struct device_driver * drv)
 {
-	struct list_head * entry, * next;
-	list_for_each_safe(entry, next, &drv->devices) {
-		struct device * dev = container_of(entry, struct device, driver_list);
+	while (!list_empty(&drv->devices)) {
+		struct device * dev = container_of(drv->devices.next, struct device, driver_list);
 		device_release_driver(dev);
 	}
 }