panic in sysmon_envsys_unregister()

[Christoph Badura <bad%bsd.de@localhost>]

Testing yesterday's current on my ThinkPad W500 I get:


wm0: detached
uvm_fault(0xffffd1e2324a95c0, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff806ca727 cs 0x8 rflags 0x10286 cr2 0x11
ilevel 0 rsp 0xffff898067a41d90
curlwp 0xffffd1e265441760 pid 1048.1 lowest kstack 0xffff898067a3e2c0
Skipping crash dump on recursive panic
panic: trap
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x160
snprintf() at netbsd:snprintf
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0xc8
sysmon_envsys_unregister() at netbsd:sysmon_envsys_unregister+0xd3
thinkpad_detach() at netbsd:thinkpad_detach+0x6f
config_detach() at netbsd:config_detach+0xe4
config_detach_all() at netbsd:config_detach_all+0x9f
cpu_reboot() at netbsd:cpu_reboot+0x137
sys_reboot() at netbsd:sys_reboot+0x75
syscall() at netbsd:syscall+0x173
--- syscall (number 208) ---
76b281e42dfa:
cpu0: End traceback...

This is caught by QUEUEDEBUG.

This is the relevant code in sys/dev/sysmon/sysmon_envsys.c:sysmon_envsys_unregister()

	TAILQ_FOREACH(edata, &sme->sme_sensors_list, sensors_head) {
		sysmon_envsys_sensor_detach(sme, edata);
	}

sysmon_envsys_sensor_detach() TAILQ_FOREACHs over sme_sensors_list itself
and removes edata.

Is using TAILQ_FOREACH_SAFE in sysmon_envsys_unregister() the right fix?

--chris