From aca94500e637c6889b97257655342f9d327f8b24 Mon Sep 17 00:00:00 2001
From: Jarek Poplawski <jarkao2@gmail.com>
Date: Thu, 10 Jan 2008 21:21:20 -0800
Subject: [PATCH] --- yaml --- r: 75491 b: refs/heads/master c:
 ecd2ebdea350c40e73c00d400d74c8a09c072082 h: refs/heads/master i:   75489:
 4c50ef3bb5f5e8a0dc854dfa71f4a00a1d97a9a9   75487:
 3159dbe1c2f6e375f4420aea74a903c781576937 v: v3

---
 [refs]                   |  2 +-
 trunk/net/ax25/af_ax25.c | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 7bb7c4292a64..6d0551567add 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 27d1cba21fcc50c37eef5042c6be9fa7135e88fc
+refs/heads/master: ecd2ebdea350c40e73c00d400d74c8a09c072082
diff --git a/trunk/net/ax25/af_ax25.c b/trunk/net/ax25/af_ax25.c
index ecb14ee00498..b4725ff317c0 100644
--- a/trunk/net/ax25/af_ax25.c
+++ b/trunk/net/ax25/af_ax25.c
@@ -87,10 +87,22 @@ static void ax25_kill_by_device(struct net_device *dev)
 		return;
 
 	spin_lock_bh(&ax25_list_lock);
+again:
 	ax25_for_each(s, node, &ax25_list) {
 		if (s->ax25_dev == ax25_dev) {
 			s->ax25_dev = NULL;
+			spin_unlock_bh(&ax25_list_lock);
 			ax25_disconnect(s, ENETUNREACH);
+			spin_lock_bh(&ax25_list_lock);
+
+			/* The entry could have been deleted from the
+			 * list meanwhile and thus the next pointer is
+			 * no longer valid.  Play it safe and restart
+			 * the scan.  Forward progress is ensured
+			 * because we set s->ax25_dev to NULL and we
+			 * are never passed a NULL 'dev' argument.
+			 */
+			goto again;
 		}
 	}
 	spin_unlock_bh(&ax25_list_lock);