Automatic merge of /spare/repo/netdev-2.6 branch use-after-unmap

13 files changed, 28 insertions, 4 deletions

diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index 8263b3a5d8d7..fc5263c6b102 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -290,6 +290,8 @@ static void ahci_host_stop(struct ata_host_set *host_set)
 {
         struct ahci_host_priv *hpriv = host_set->private_data;
         kfree(hpriv);
+
+        ata_host_stop(host_set);
 }
 
 static int ahci_port_start(struct ata_port *ap)
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 3867f91ef8c7..54c52349adc5 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -153,6 +153,7 @@ static struct ata_port_operations piix_pata_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_operations piix_sata_ops = {
@@ -180,6 +181,7 @@ static struct ata_port_operations piix_sata_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info piix_port_info[] = {
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 63d3f70d06e1..30a88f0e7bd6 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -3322,6 +3322,13 @@ void ata_port_stop (struct ata_port *ap)
         dma_free_coherent(dev, ATA_PRD_TBL_SZ, ap->prd, ap->prd_dma);
 }
 
+void ata_host_stop (struct ata_host_set *host_set)
+{
+        if (host_set->mmio_base)
+                iounmap(host_set->mmio_base);
+}
+
+
 /**
  *      ata_host_remove - Unregister SCSI host structure with upper layers
  *      @ap: Port to unregister
@@ -3878,10 +3885,6 @@ void ata_pci_remove_one (struct pci_dev *pdev)
         }
 
         free_irq(host_set->irq, host_set);
-        if (host_set->ops->host_stop)
-                host_set->ops->host_stop(host_set);
-        if (host_set->mmio_base)
-                iounmap(host_set->mmio_base);
 
         for (i = 0; i < host_set->n_ports; i++) {
                 ap = host_set->ports[i];
@@ -3900,6 +3903,9 @@ void ata_pci_remove_one (struct pci_dev *pdev)
                 scsi_host_put(ap->host);
         }
 
+        if (host_set->ops->host_stop)
+                host_set->ops->host_stop(host_set);
+
         kfree(host_set);
 
         pci_release_regions(pdev);
@@ -3997,6 +4003,7 @@ EXPORT_SYMBOL_GPL(ata_chk_err);
 EXPORT_SYMBOL_GPL(ata_exec_command);
 EXPORT_SYMBOL_GPL(ata_port_start);
 EXPORT_SYMBOL_GPL(ata_port_stop);
+EXPORT_SYMBOL_GPL(ata_host_stop);
 EXPORT_SYMBOL_GPL(ata_interrupt);
 EXPORT_SYMBOL_GPL(ata_qc_prep);
 EXPORT_SYMBOL_GPL(ata_bmdma_setup);
diff --git a/drivers/scsi/sata_nv.c b/drivers/scsi/sata_nv.c
index 69009f853a49..b0403ccd8a25 100644
--- a/drivers/scsi/sata_nv.c
+++ b/drivers/scsi/sata_nv.c
@@ -329,6 +329,8 @@ static void nv_host_stop (struct ata_host_set *host_set)
                 host->host_desc->disable_hotplug(host_set);
 
         kfree(host);
+
+        ata_host_stop(host_set);
 }
 
 static int nv_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index c4e9e0298122..b18c90582e67 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -122,6 +122,7 @@ static struct ata_port_operations pdc_ata_ops = {
         .scr_write              = pdc_sata_scr_write,
         .port_start             = pdc_port_start,
         .port_stop              = pdc_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info pdc_port_info[] = {
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c
index dfd362104717..1383e8a28d72 100644
--- a/drivers/scsi/sata_qstor.c
+++ b/drivers/scsi/sata_qstor.c
@@ -536,6 +536,8 @@ static void qs_host_stop(struct ata_host_set *host_set)
 
         writeb(0, mmio_base + QS_HCT_CTRL); /* disable host interrupts */
         writeb(QS_CNFG3_GSRST, mmio_base + QS_HCF_CNFG3); /* global reset */
+
+        ata_host_stop(host_set);
 }
 
 static void qs_host_init(unsigned int chip_id, struct ata_probe_ent *pe)
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 2b2ff48be396..238580d244e6 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -161,6 +161,7 @@ static struct ata_port_operations sil_ops = {
         .scr_write              = sil_scr_write,
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info sil_port_info[] = {
diff --git a/drivers/scsi/sata_sis.c b/drivers/scsi/sata_sis.c
index 5105ddd08447..e418b89c6b9d 100644
--- a/drivers/scsi/sata_sis.c
+++ b/drivers/scsi/sata_sis.c
@@ -114,6 +114,7 @@ static struct ata_port_operations sis_ops = {
         .scr_write              = sis_scr_write,
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info sis_port_info = {
diff --git a/drivers/scsi/sata_svw.c b/drivers/scsi/sata_svw.c
index 05075bd3a893..edef1fa969fc 100644
--- a/drivers/scsi/sata_svw.c
+++ b/drivers/scsi/sata_svw.c
@@ -313,6 +313,7 @@ static struct ata_port_operations k2_sata_ops = {
         .scr_write              = k2_sata_scr_write,
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static void k2_sata_setup_port(struct ata_ioports *port, unsigned long base)
diff --git a/drivers/scsi/sata_sx4.c b/drivers/scsi/sata_sx4.c
index 70118650c461..140cea05de3f 100644
--- a/drivers/scsi/sata_sx4.c
+++ b/drivers/scsi/sata_sx4.c
@@ -245,6 +245,8 @@ static void pdc20621_host_stop(struct ata_host_set *host_set)
 
         iounmap(dimm_mmio);
         kfree(hpriv);
+
+        ata_host_stop(host_set);
 }
 
 static int pdc_port_start(struct ata_port *ap)
diff --git a/drivers/scsi/sata_uli.c b/drivers/scsi/sata_uli.c
index 0bff4f475f26..a71fb54eebd3 100644
--- a/drivers/scsi/sata_uli.c
+++ b/drivers/scsi/sata_uli.c
@@ -113,6 +113,7 @@ static struct ata_port_operations uli_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info uli_port_info = {
diff --git a/drivers/scsi/sata_via.c b/drivers/scsi/sata_via.c
index 3a7830667277..f43183c19a12 100644
--- a/drivers/scsi/sata_via.c
+++ b/drivers/scsi/sata_via.c
@@ -134,6 +134,7 @@ static struct ata_port_operations svia_sata_ops = {
 
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static struct ata_port_info svia_port_info = {
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index 05e0130a9f3c..c5e09dc6f3de 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -231,6 +231,7 @@ static struct ata_port_operations vsc_sata_ops = {
         .scr_write              = vsc_sata_scr_write,
         .port_start             = ata_port_start,
         .port_stop              = ata_port_stop,
+        .host_stop              = ata_host_stop,
 };
 
 static void __devinit vsc_sata_setup_port(struct ata_ioports *port, unsigned long base)