staging: ozwpan: handle race in remove binding

Make sure we remove node from list while we still
hold lock.

Bug 1474422

Change-Id: I7e23f6432f347937b1883ea086e55f5c324fc985
Signed-off-by: Rupesh Gujare <rupesh.gujare@atmel.com>
Signed-off-by: Vinayak Pane <vpane@nvidia.com>
Reviewed-on: http://git-master/r/380497
Reviewed-by: Bibhay Ranjan <bibhayr@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

diff --git a/drivers/staging/ozwpan/ozproto.c b/drivers/staging/ozwpan/ozproto.c
index f0ac432835889abcd62f6e873ce1933a5a7a5861..8cb25b285c6a30db1d02433d2ed2820d5b0c7930 100644 (file)
--- a/drivers/staging/ozwpan/ozproto.c
+++ b/drivers/staging/ozwpan/ozproto.c
@@ -747,14 +747,15 @@ static void pd_stop_all_for_device(struct net_device *net_dev)
  */
 void oz_binding_remove(const char *net_dev)
 {
-       struct oz_binding *binding;
+       struct oz_binding *binding, *tmp;
        int found = 0;
 
        oz_trace_msg(M, "Removing binding: '%s'\n", net_dev);
        spin_lock_bh(&g_binding_lock);
-       list_for_each_entry(binding, &g_binding, link) {
+       list_for_each_entry_safe(binding, tmp, &g_binding, link) {
                if (compare_binding_name(binding->name, net_dev)) {
                        oz_trace_msg(M, "Binding '%s' found\n", net_dev);
+                       list_del(&binding->link);
                        found = 1;
                        break;
                }
@@ -767,7 +768,6 @@ void oz_binding_remove(const char *net_dev)
                        dev_put(binding->ptype.dev);
                        pd_stop_all_for_device(binding->ptype.dev);
                }
-               list_del(&binding->link);
                kfree(binding);
        }
 }