rkagan@mail.ru [PATCH] drivers/base/bus.c: fix iteration in driver_detach() [PATCH] drivers/base/bus.c: fix iteration in driver_detach() With 2.6.11 and 2.6.12-rc2 (and perhaps a few versions before) usb drivers for multi-interface devices, which do usb_driver_release_interface() in their disconnect(), make rmmod hang. It turns out to be due to a bug in drivers/base/bus.c:driver_detach(), that iterates over the list of attached devices with list_for_each_safe() under an assumption that device_release_driver() only releases the current device, while it may also call device_release_driver() for other devices on the same list. The following patch fixes it. Please consider applying. Signed-off-by: Roman Kagan Signed-off-by: Greg Kroah-Hartman --- commit b2d84f078a8be40f5ae3b4d2ac001e2a7f45fe4f tree 173f941991f1b68da820e9926a3b7ebdd3a2c8b9 parent 177a4324944478f2799ce4ede2797cb0f602f274 author Roman Kagan 1113414017 +0400 committer Greg KH 1115275478 -0700 Index: drivers/base/bus.c =================================================================== --- cc42dcdbce1c3b53ea147abd3ebf784f0d2bf1bc/drivers/base/bus.c (mode:100644 sha1:f4fa27315fb4b69841ecf2a551d58d9a241c5546) +++ 173f941991f1b68da820e9926a3b7ebdd3a2c8b9/drivers/base/bus.c (mode:100644 sha1:2b3902c867dab76cf5b9b9d65d1778be20ac20e1) @@ -405,9 +405,8 @@ static void driver_detach(struct device_driver * drv) { - struct list_head * entry, * next; - list_for_each_safe(entry, next, &drv->devices) { - struct device * dev = container_of(entry, struct device, driver_list); + while (!list_empty(&drv->devices)) { + struct device * dev = container_of(drv->devices.next, struct device, driver_list); device_release_driver(dev); } }