From owner-svn-src-all@freebsd.org  Mon Oct 17 10:20:45 2016
Return-Path: <owner-svn-src-all@freebsd.org>
Delivered-To: svn-src-all@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 15B1EC15A30;
 Mon, 17 Oct 2016 10:20:45 +0000 (UTC)
 (envelope-from hselasky@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id CFEED319;
 Mon, 17 Oct 2016 10:20:44 +0000 (UTC)
 (envelope-from hselasky@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u9HAKimG078781;
 Mon, 17 Oct 2016 10:20:44 GMT (envelope-from hselasky@FreeBSD.org)
Received: (from hselasky@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id u9HAKdWO076718;
 Mon, 17 Oct 2016 10:20:39 GMT (envelope-from hselasky@FreeBSD.org)
Message-Id: <201610171020.u9HAKdWO076718@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: hselasky set sender to
 hselasky@FreeBSD.org using -f
From: Hans Petter Selasky <hselasky@FreeBSD.org>
Date: Mon, 17 Oct 2016 10:20:39 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r307518 - in head/sys: arm/allwinner arm/at91
 arm/cavium/cns11xx arm/samsung/exynos arm/ti/am335x arm/ti/usb arm/xilinx
 boot/kshim dev/bhnd/cores/usb dev/puc dev/usb dev/usb/controller ...
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all/>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Oct 2016 10:20:45 -0000

Author: hselasky
Date: Mon Oct 17 10:20:38 2016
New Revision: 307518
URL: https://svnweb.freebsd.org/changeset/base/307518

Log:
  Fix device delete child function.
  
  When detaching device trees parent devices must be detached prior to
  detaching its children. This is because parent devices can have
  pointers to the child devices in their softcs which are not
  invalidated by device_delete_child(). This can cause use after free
  issues and panic().
  
  Device drivers implementing trees, must ensure its detach function
  detaches or deletes all its children before returning.
  
  While at it remove now redundant device_detach() calls before
  device_delete_child() and device_delete_children(), mostly in
  the USB controller drivers.
  
  Tested by:		Jan Henrik Sylvester <me@janh.de>
  Reviewed by:		jhb
  Differential Revision:	https://reviews.freebsd.org/D8070
  MFC after:		2 weeks

Modified:
  head/sys/arm/allwinner/a10_ehci.c
  head/sys/arm/at91/at91_ohci.c
  head/sys/arm/at91/at91_ohci_fdt.c
  head/sys/arm/cavium/cns11xx/ehci_ebus.c
  head/sys/arm/cavium/cns11xx/ohci_ec.c
  head/sys/arm/samsung/exynos/exynos5_xhci.c
  head/sys/arm/ti/am335x/am335x_musb.c
  head/sys/arm/ti/usb/omap_ehci.c
  head/sys/arm/xilinx/zy7_ehci.c
  head/sys/boot/kshim/bsd_kernel.c
  head/sys/dev/bhnd/cores/usb/bhnd_ehci.c
  head/sys/dev/bhnd/cores/usb/bhnd_ohci.c
  head/sys/dev/puc/puc.c
  head/sys/dev/usb/controller/at91dci_atmelarm.c
  head/sys/dev/usb/controller/at91dci_fdt.c
  head/sys/dev/usb/controller/atmegadci_atmelarm.c
  head/sys/dev/usb/controller/dwc_otg_fdt.c
  head/sys/dev/usb/controller/ehci_ixp4xx.c
  head/sys/dev/usb/controller/ehci_mv.c
  head/sys/dev/usb/controller/ehci_pci.c
  head/sys/dev/usb/controller/generic_ehci.c
  head/sys/dev/usb/controller/generic_ohci.c
  head/sys/dev/usb/controller/musb_otg_atmelarm.c
  head/sys/dev/usb/controller/ohci_pci.c
  head/sys/dev/usb/controller/ohci_s3c24x0.c
  head/sys/dev/usb/controller/saf1761_otg_boot.c
  head/sys/dev/usb/controller/saf1761_otg_fdt.c
  head/sys/dev/usb/controller/uhci_pci.c
  head/sys/dev/usb/controller/uss820dci_atmelarm.c
  head/sys/dev/usb/controller/xhci_mv.c
  head/sys/dev/usb/controller/xhci_pci.c
  head/sys/dev/usb/usb_device.c
  head/sys/dev/usb/video/udl.c
  head/sys/kern/subr_bus.c
  head/sys/mips/atheros/ar71xx_ehci.c
  head/sys/mips/atheros/ar71xx_ohci.c
  head/sys/mips/cavium/usb/octusb_octeon.c
  head/sys/mips/mediatek/mtk_dotg.c
  head/sys/mips/mediatek/mtk_ehci.c
  head/sys/mips/mediatek/mtk_ohci.c
  head/sys/mips/mediatek/mtk_xhci.c
  head/sys/mips/rmi/xls_ehci.c
  head/sys/mips/rt305x/rt305x_dotg.c
  head/sys/mips/rt305x/rt305x_ehci.c
  head/sys/mips/rt305x/rt305x_ohci.c

Modified: head/sys/arm/allwinner/a10_ehci.c
==============================================================================
--- head/sys/arm/allwinner/a10_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/allwinner/a10_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -275,17 +275,11 @@ a10_ehci_detach(device_t self)
 	struct aw_ehci_softc *aw_sc = device_get_softc(self);
 	ehci_softc_t *sc = &aw_sc->sc;
 	const struct aw_ehci_conf *conf;
-	device_t bdev;
 	int err;
 	uint32_t reg_value = 0;
 
 	conf = USB_CONF(self);
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/arm/at91/at91_ohci.c
==============================================================================
--- head/sys/arm/at91/at91_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/at91/at91_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -165,14 +165,8 @@ static int
 ohci_atmelarm_detach(device_t dev)
 {
 	struct at91_ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_ohci.sc_bus.bdev) {
-		bdev = sc->sc_ohci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/arm/at91/at91_ohci_fdt.c
==============================================================================
--- head/sys/arm/at91/at91_ohci_fdt.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/at91/at91_ohci_fdt.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -171,14 +171,8 @@ static int
 ohci_at91_fdt_detach(device_t dev)
 {
 	struct at91_ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_ohci.sc_bus.bdev) {
-		bdev = sc->sc_ohci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/arm/cavium/cns11xx/ehci_ebus.c
==============================================================================
--- head/sys/arm/cavium/cns11xx/ehci_ebus.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/cavium/cns11xx/ehci_ebus.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -184,14 +184,8 @@ static int
 ehci_ebus_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/arm/cavium/cns11xx/ohci_ec.c
==============================================================================
--- head/sys/arm/cavium/cns11xx/ohci_ec.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/cavium/cns11xx/ohci_ec.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -177,14 +177,8 @@ static int
 ohci_ec_detach(device_t dev)
 {
 	struct ec_ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_ohci.sc_bus.bdev) {
-		bdev = sc->sc_ohci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/arm/samsung/exynos/exynos5_xhci.c
==============================================================================
--- head/sys/arm/samsung/exynos/exynos5_xhci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/samsung/exynos/exynos5_xhci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -288,14 +288,8 @@ static int
 exynos_xhci_detach(device_t dev)
 {
 	struct exynos_xhci_softc *esc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (esc->base.sc_bus.bdev != NULL) {
-		bdev = esc->base.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* During module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/arm/ti/am335x/am335x_musb.c
==============================================================================
--- head/sys/arm/ti/am335x/am335x_musb.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/ti/am335x/am335x_musb.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -366,14 +366,10 @@ static int
 musbotg_detach(device_t dev)
 {
 	struct musbotg_super_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_otg.sc_bus.bdev) {
-		bdev = sc->sc_otg.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
+	/* during module unload there are lots of children leftover */
+	device_delete_children(dev);
 
 	if (sc->sc_otg.sc_irq_res && sc->sc_otg.sc_intr_hdl) {
 		/*
@@ -397,9 +393,6 @@ musbotg_detach(device_t dev)
 		bus_release_resource(dev, SYS_RES_IRQ, sc->sc_irq_rid,
 		    sc->sc_otg.sc_irq_res);
 
-	/* during module unload there are lots of children leftover */
-	device_delete_children(dev);
-
 	return (0);
 }
 

Modified: head/sys/arm/ti/usb/omap_ehci.c
==============================================================================
--- head/sys/arm/ti/usb/omap_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/ti/usb/omap_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -392,15 +392,8 @@ omap_ehci_detach(device_t dev)
 {
 	struct omap_ehci_softc *isc = device_get_softc(dev);
 	ehci_softc_t *sc = &isc->base;
-	device_t bdev;
 	int err;
 	
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
-
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 	

Modified: head/sys/arm/xilinx/zy7_ehci.c
==============================================================================
--- head/sys/arm/xilinx/zy7_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/arm/xilinx/zy7_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -323,20 +323,17 @@ zy7_ehci_detach(device_t dev)
 {
 	ehci_softc_t *sc = device_get_softc(dev);
 
+	/* during module unload there are lots of children leftover */
+	device_delete_children(dev);
+	
 	sc->sc_flags &= ~EHCI_SCFLG_DONEINIT;
 
-	if (device_is_attached(dev))
-		bus_generic_detach(dev);
-
 	if (sc->sc_irq_res && sc->sc_intr_hdl)
 		/* call ehci_detach() after ehci_init() called after
 		 * successful bus_setup_intr().
 		 */
 		ehci_detach(sc);
-	if (sc->sc_bus.bdev) {
-		device_detach(sc->sc_bus.bdev);
-		device_delete_child(dev, sc->sc_bus.bdev);
-	}
+
 	if (sc->sc_irq_res) {
 		if (sc->sc_intr_hdl != NULL)
 			bus_teardown_intr(dev, sc->sc_irq_res,

Modified: head/sys/boot/kshim/bsd_kernel.c
==============================================================================
--- head/sys/boot/kshim/bsd_kernel.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/boot/kshim/bsd_kernel.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -817,8 +817,12 @@ device_delete_child(device_t dev, device
 	int error = 0;
 	device_t grandchild;
 
-	/* remove children first */
+	/* detach parent before deleting children, if any */
+	error = device_detach(child);
+	if (error)
+		goto done;
 
+	/* remove children second */
 	while ((grandchild = TAILQ_FIRST(&child->dev_children))) {
 		error = device_delete_child(child, grandchild);
 		if (error) {
@@ -827,11 +831,6 @@ device_delete_child(device_t dev, device
 		}
 	}
 
-	error = device_detach(child);
-
-	if (error)
-		goto done;
-
 	devclass_delete_device(child->dev_module, child);
 
 	if (dev != NULL) {

Modified: head/sys/dev/bhnd/cores/usb/bhnd_ehci.c
==============================================================================
--- head/sys/dev/bhnd/cores/usb/bhnd_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/bhnd/cores/usb/bhnd_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -191,16 +191,10 @@ static int
 bhnd_ehci_detach(device_t self)
 {
 	ehci_softc_t	*sc;
-	device_t	 bdev;
 	int		 err;
 
 	sc = device_get_softc(self);
 
- 	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/bhnd/cores/usb/bhnd_ohci.c
==============================================================================
--- head/sys/dev/bhnd/cores/usb/bhnd_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/bhnd/cores/usb/bhnd_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -163,15 +163,9 @@ static int
 bhnd_ohci_detach(device_t self)
 {
 	ohci_softc_t	*sc;
-	device_t	 bdev;
 
 	sc = device_get_softc(self);
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/puc/puc.c
==============================================================================
--- head/sys/dev/puc/puc.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/puc/puc.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -414,8 +414,7 @@ puc_bfe_detach(device_t dev)
 		port = &sc->sc_port[idx];
 		if (port->p_dev == NULL)
 			continue;
-		if (device_detach(port->p_dev) == 0) {
-			device_delete_child(dev, port->p_dev);
+		if (device_delete_child(dev, port->p_dev) == 0) {
 			if (port->p_rres != NULL)
 				rman_release_resource(port->p_rres);
 			if (port->p_ires != NULL)

Modified: head/sys/dev/usb/controller/at91dci_atmelarm.c
==============================================================================
--- head/sys/dev/usb/controller/at91dci_atmelarm.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/at91dci_atmelarm.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -243,14 +243,8 @@ static int
 at91_udp_detach(device_t dev)
 {
 	struct at91_udp_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_dci.sc_bus.bdev) {
-		bdev = sc->sc_dci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/at91dci_fdt.c
==============================================================================
--- head/sys/dev/usb/controller/at91dci_fdt.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/at91dci_fdt.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -249,14 +249,8 @@ static int
 at91_udp_detach(device_t dev)
 {
 	struct at91_udp_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_dci.sc_bus.bdev) {
-		bdev = sc->sc_dci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/atmegadci_atmelarm.c
==============================================================================
--- head/sys/dev/usb/controller/atmegadci_atmelarm.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/atmegadci_atmelarm.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -155,14 +155,8 @@ static int
 atmegadci_detach(device_t dev)
 {
 	struct atmegadci_super_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_otg.sc_bus.bdev) {
-		bdev = sc->sc_otg.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/dwc_otg_fdt.c
==============================================================================
--- head/sys/dev/usb/controller/dwc_otg_fdt.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/dwc_otg_fdt.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -163,14 +163,8 @@ static int
 dwc_otg_detach(device_t dev)
 {
 	struct dwc_otg_fdt_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_otg.sc_bus.bdev) {
-		bdev = sc->sc_otg.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/ehci_ixp4xx.c
==============================================================================
--- head/sys/dev/usb/controller/ehci_ixp4xx.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/ehci_ixp4xx.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -221,14 +221,8 @@ ehci_ixp_detach(device_t self)
 {
 	struct ixp_ehci_softc *isc = device_get_softc(self);
 	ehci_softc_t *sc = &isc->base;
-	device_t bdev;
 	int err;
 
- 	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/ehci_mv.c
==============================================================================
--- head/sys/dev/usb/controller/ehci_mv.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/ehci_mv.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -264,14 +264,8 @@ static int
 mv_ehci_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/ehci_pci.c
==============================================================================
--- head/sys/dev/usb/controller/ehci_pci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/ehci_pci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -477,13 +477,7 @@ static int
 ehci_pci_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/generic_ehci.c
==============================================================================
--- head/sys/dev/usb/controller/generic_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/generic_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -156,14 +156,8 @@ static int
 generic_ehci_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/generic_ohci.c
==============================================================================
--- head/sys/dev/usb/controller/generic_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/generic_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -214,18 +214,11 @@ static int
 generic_ohci_detach(device_t dev)
 {
 	struct generic_ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 #ifdef EXT_RESOURCES
 	struct clk_list *clk, *clk_tmp;
 #endif
 
-	if (sc->ohci_sc.sc_bus.bdev) {
-		bdev = sc->ohci_sc.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
-
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/musb_otg_atmelarm.c
==============================================================================
--- head/sys/dev/usb/controller/musb_otg_atmelarm.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/musb_otg_atmelarm.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -204,14 +204,8 @@ static int
 musbotg_detach(device_t dev)
 {
 	struct musbotg_super_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_otg.sc_bus.bdev) {
-		bdev = sc->sc_otg.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/ohci_pci.c
==============================================================================
--- head/sys/dev/usb/controller/ohci_pci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/ohci_pci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -335,13 +335,7 @@ static int
 ohci_pci_detach(device_t self)
 {
 	ohci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/ohci_s3c24x0.c
==============================================================================
--- head/sys/dev/usb/controller/ohci_s3c24x0.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/ohci_s3c24x0.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -148,14 +148,8 @@ static int
 ohci_s3c24x0_detach(device_t dev)
 {
 	struct ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/saf1761_otg_boot.c
==============================================================================
--- head/sys/dev/usb/controller/saf1761_otg_boot.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/saf1761_otg_boot.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -124,13 +124,6 @@ static int
 saf1761_otg_fdt_detach(device_t dev)
 {
 	struct saf1761_otg_softc *sc = device_get_softc(dev);
-	device_t bdev;
-
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);

Modified: head/sys/dev/usb/controller/saf1761_otg_fdt.c
==============================================================================
--- head/sys/dev/usb/controller/saf1761_otg_fdt.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/saf1761_otg_fdt.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -238,14 +238,8 @@ static int
 saf1761_otg_fdt_detach(device_t dev)
 {
 	struct saf1761_otg_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/uhci_pci.c
==============================================================================
--- head/sys/dev/usb/controller/uhci_pci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/uhci_pci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -393,13 +393,7 @@ int
 uhci_pci_detach(device_t self)
 {
 	uhci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/controller/uss820dci_atmelarm.c
==============================================================================
--- head/sys/dev/usb/controller/uss820dci_atmelarm.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/uss820dci_atmelarm.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -164,14 +164,8 @@ static int
 uss820_atmelarm_detach(device_t dev)
 {
 	struct uss820dci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/xhci_mv.c
==============================================================================
--- head/sys/dev/usb/controller/xhci_mv.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/xhci_mv.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -171,15 +171,8 @@ static int
 xhci_detach(device_t dev)
 {
 	struct xhci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev != NULL) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
-
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/dev/usb/controller/xhci_pci.c
==============================================================================
--- head/sys/dev/usb/controller/xhci_pci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/controller/xhci_pci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -340,13 +340,7 @@ static int
 xhci_pci_detach(device_t self)
 {
 	struct xhci_softc *sc = device_get_softc(self);
-	device_t bdev;
 
-	if (sc->sc_bus.bdev != NULL) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/dev/usb/usb_device.c
==============================================================================
--- head/sys/dev/usb/usb_device.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/usb_device.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -1103,10 +1103,8 @@ usb_detach_device_sub(struct usb_device 
 					device_printf(dev, "Resume failed\n");
 				}
 			}
-			if (device_detach(dev)) {
-				goto error;
-			}
 		}
+		/* detach and delete child */
 		if (device_delete_child(udev->parent_dev, dev)) {
 			goto error;
 		}

Modified: head/sys/dev/usb/video/udl.c
==============================================================================
--- head/sys/dev/usb/video/udl.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/dev/usb/video/udl.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -443,14 +443,9 @@ udl_detach(device_t dev)
 {
 	struct udl_softc *sc = device_get_softc(dev);
 
-	if (sc->sc_fbdev != NULL) {
-		device_t bdev;
+	/* delete all child devices */
+	device_delete_children(dev);
 
-		bdev = sc->sc_fbdev;
-		sc->sc_fbdev = NULL;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	UDL_LOCK(sc);
 	sc->sc_gone = 1;
 	callout_stop(&sc->sc_callout);

Modified: head/sys/kern/subr_bus.c
==============================================================================
--- head/sys/kern/subr_bus.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/kern/subr_bus.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -1949,15 +1949,17 @@ device_delete_child(device_t dev, device
 
 	PDEBUG(("%s from %s", DEVICENAME(child), DEVICENAME(dev)));
 
-	/* remove children first */
+	/* detach parent before deleting children, if any */
+	if ((error = device_detach(child)) != 0)
+		return (error);
+	
+	/* remove children second */
 	while ((grandchild = TAILQ_FIRST(&child->children)) != NULL) {
 		error = device_delete_child(child, grandchild);
 		if (error)
 			return (error);
 	}
 
-	if ((error = device_detach(child)) != 0)
-		return (error);
 	if (child->devclass)
 		devclass_delete_device(child->devclass, child);
 	if (child->parent)

Modified: head/sys/mips/atheros/ar71xx_ehci.c
==============================================================================
--- head/sys/mips/atheros/ar71xx_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/atheros/ar71xx_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -231,14 +231,8 @@ ar71xx_ehci_detach(device_t self)
 {
 	struct ar71xx_ehci_softc *isc = device_get_softc(self);
 	ehci_softc_t *sc = &isc->base;
-	device_t bdev;
 	int err;
 
- 	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/atheros/ar71xx_ohci.c
==============================================================================
--- head/sys/mips/atheros/ar71xx_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/atheros/ar71xx_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -156,13 +156,7 @@ static int
 ar71xx_ohci_detach(device_t dev)
 {
 	struct ar71xx_ohci_softc *sc = device_get_softc(dev);
-	device_t bdev;
 
-	if (sc->sc_ohci.sc_bus.bdev) {
-		bdev = sc->sc_ohci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/mips/cavium/usb/octusb_octeon.c
==============================================================================
--- head/sys/mips/cavium/usb/octusb_octeon.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/cavium/usb/octusb_octeon.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -160,16 +160,10 @@ static int
 octusb_octeon_detach(device_t dev)
 {
 	struct octusb_octeon_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 	int nports;
 	int i;
 
-	if (sc->sc_dci.sc_bus.bdev) {
-		bdev = sc->sc_dci.sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/mips/mediatek/mtk_dotg.c
==============================================================================
--- head/sys/mips/mediatek/mtk_dotg.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/mediatek/mtk_dotg.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -161,14 +161,8 @@ static int
 dotg_fdt_detach(device_t dev)
 {
 	struct dwc_otg_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/mips/mediatek/mtk_ehci.c
==============================================================================
--- head/sys/mips/mediatek/mtk_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/mediatek/mtk_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -162,14 +162,8 @@ static int
 ehci_fdt_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/mediatek/mtk_ohci.c
==============================================================================
--- head/sys/mips/mediatek/mtk_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/mediatek/mtk_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -162,14 +162,8 @@ static int
 ohci_fdt_detach(device_t self)
 {
 	ohci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/mediatek/mtk_xhci.c
==============================================================================
--- head/sys/mips/mediatek/mtk_xhci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/mediatek/mtk_xhci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -161,14 +161,8 @@ static int
 mtk_xhci_fdt_detach(device_t self)
 {
 	struct xhci_softc *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/rmi/xls_ehci.c
==============================================================================
--- head/sys/mips/rmi/xls_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/rmi/xls_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -164,14 +164,8 @@ static int
 ehci_xls_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
- 	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/rt305x/rt305x_dotg.c
==============================================================================
--- head/sys/mips/rt305x/rt305x_dotg.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/rt305x/rt305x_dotg.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -173,14 +173,8 @@ static int
 dotg_obio_detach(device_t dev)
 {
 	struct dwc_otg_softc *sc = device_get_softc(dev);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(dev, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(dev);
 

Modified: head/sys/mips/rt305x/rt305x_ehci.c
==============================================================================
--- head/sys/mips/rt305x/rt305x_ehci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/rt305x/rt305x_ehci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -175,14 +175,8 @@ static int
 ehci_obio_detach(device_t self)
 {
 	ehci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);
 

Modified: head/sys/mips/rt305x/rt305x_ohci.c
==============================================================================
--- head/sys/mips/rt305x/rt305x_ohci.c	Mon Oct 17 09:40:18 2016	(r307517)
+++ head/sys/mips/rt305x/rt305x_ohci.c	Mon Oct 17 10:20:38 2016	(r307518)
@@ -175,14 +175,8 @@ static int
 ohci_obio_detach(device_t self)
 {
 	ohci_softc_t *sc = device_get_softc(self);
-	device_t bdev;
 	int err;
 
-	if (sc->sc_bus.bdev) {
-		bdev = sc->sc_bus.bdev;
-		device_detach(bdev);
-		device_delete_child(self, bdev);
-	}
 	/* during module unload there are lots of children leftover */
 	device_delete_children(self);