From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Date: Thu, 21 Feb 2008 06:24:16 +0000 (+0900)
Subject: PCI: Fix wrong reference counter check for proc_dir_entry
X-Git-Tag: v2.6.25-rc3~97^2
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79df4c60c5b24ebc90f591d5991b22782813fcfe;p=linux-2.6

PCI: Fix wrong reference counter check for proc_dir_entry

Fix wrong counter check for proc_dir_entry in pci_proc_detach_device().

The pci_proc_detach_device() returns with -EBUSY before calling
remove_proc_entry() if the reference counter of proc_dir_entry is not
0. But this check is wrong and pci_proc_detach_device() always fails
because the reference counter of proc_dir_entry is initialized with 1
at creating time and decremented in remove_proc_entry(). This bug
cause strange behaviour as followings:

- Accessing /proc/bus/pci/XXXX/YY file after hot-removing pci adapter
  card causes kernel panic.

- Repeating hot-add/hot-remove of pci adapter card increases files
  with the same name under /proc/bus/pci/XXXX/ directory. For example:

    # pwd
    /proc/bus/pci/0002:09
    # ls
    01.0
    # for i in `seq 5`
    > do
    > echo 0 > /sys/bus/pci/slots/0009_0032/power
    > echo 1 > /sys/bus/pci/slots/0009_0032/power
    > done
    # ls
    01.0  01.0  01.0  01.0  01.0  01.0

The pci_proc_detach_device() should check if the reference counter is
not larger than 1 instead.

Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index 68aeeb7206..ef18fcd641 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -422,7 +422,7 @@ int pci_proc_detach_device(struct pci_dev *dev)
 	struct proc_dir_entry *e;
 
 	if ((e = dev->procent)) {
-		if (atomic_read(&e->count))
+		if (atomic_read(&e->count) > 1)
 			return -EBUSY;
 		remove_proc_entry(e->name, dev->bus->procdir);
 		dev->procent = NULL;