[PATCH] PCI: fix race with pci_walk_bus and pci_destroy_dev

pci_walk_bus has a race with pci_destroy_dev. When cb is called
in pci_walk_bus, pci_destroy_dev might unlink the dev pointed by next.
Later on in the next loop, pointer next becomes NULL and cause
kernel panic.

Below patch against 2.6.17-rc4 fixes it by changing pci_bus_lock (spin_lock)
to pci_bus_sem (rw_semaphore).

Signed-off-by: Zhang Yanmin <yanmin.zhang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 9 insertions, 8 deletions

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 27148db06ba0..f89dbc3738b7 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -383,9 +383,9 @@ struct pci_bus * __devinit pci_add_new_bus(struct pci_bus *parent, struct pci_de
 
         child = pci_alloc_child_bus(parent, dev, busnr);
         if (child) {
-                spin_lock(&pci_bus_lock);
+                down_write(&pci_bus_sem);
                 list_add_tail(&child->node, &parent->children);
-                spin_unlock(&pci_bus_lock);
+                up_write(&pci_bus_sem);
         }
         return child;
 }
@@ -844,9 +844,9 @@ void __devinit pci_device_add(struct pci_dev *dev, struct pci_bus *bus)
          * and the bus list for fixup functions, etc.
          */
         INIT_LIST_HEAD(&dev->global_list);
-        spin_lock(&pci_bus_lock);
+        down_write(&pci_bus_sem);
         list_add_tail(&dev->bus_list, &bus->devices);
-        spin_unlock(&pci_bus_lock);
+        up_write(&pci_bus_sem);
 }
 
 struct pci_dev * __devinit
@@ -981,9 +981,10 @@ struct pci_bus * __devinit pci_create_bus(struct device *parent,
                 pr_debug("PCI: Bus %04x:%02x already known\n", pci_domain_nr(b), bus);
                 goto err_out;
         }
-        spin_lock(&pci_bus_lock);
+
+        down_write(&pci_bus_sem);
         list_add_tail(&b->node, &pci_root_buses);
-        spin_unlock(&pci_bus_lock);
+        up_write(&pci_bus_sem);
 
         memset(dev, 0, sizeof(*dev));
         dev->parent = parent;
@@ -1023,9 +1024,9 @@ class_dev_create_file_err:
 class_dev_reg_err:
         device_unregister(dev);
 dev_reg_err:
-        spin_lock(&pci_bus_lock);
+        down_write(&pci_bus_sem);
         list_del(&b->node);
-        spin_unlock(&pci_bus_lock);
+        up_write(&pci_bus_sem);
 err_out:
         kfree(dev);
         kfree(b);