[PATCH] PCI Hotplug: rpaphp safe list traversal

Hoping you will accept this fix.  The bug can cause a crash upon hotplug
remove.  The bug involves unsafe traversal of a list while deleting list
members.  The fix uses list_for_each_safe() rather than
list_for_each().  Also threw in an initialization to get rid of a
compiler warning.

Signed-off-by: John Rose <johnrose@austin.ibm.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

diff --git a/drivers/pci/hotplug/rpaphp_pci.c b/drivers/pci/hotplug/rpaphp_pci.c
index 276b485d211be7099aef6927260a8a4a6b198cea..76d722f34a9c59296e54778a9ab2968e31e5eec1 100644 (file)
--- a/drivers/pci/hotplug/rpaphp_pci.c
+++ b/drivers/pci/hotplug/rpaphp_pci.c
@@ -362,7 +362,7 @@ static void rpaphp_eeh_remove_bus_device(struct pci_dev *dev)
 int rpaphp_unconfig_pci_adapter(struct slot *slot)
 {
        int retval = 0;
-       struct list_head *ln;
+       struct list_head *ln, *tmp;
 
        dbg("Entry %s: slot[%s]\n", __FUNCTION__, slot->name);
        if (list_empty(&slot->dev.pci_funcs)) {
@@ -373,7 +373,7 @@ int rpaphp_unconfig_pci_adapter(struct slot *slot)
                goto exit;
        }
        /* remove the devices from the pci core */
-       list_for_each (ln, &slot->dev.pci_funcs) {
+       list_for_each_safe (ln, tmp, &slot->dev.pci_funcs) {
                struct rpaphp_pci_func *func;
        
                func = list_entry(ln, struct rpaphp_pci_func, sibling);