Commit e73e079b authored by James Bottomley's avatar James Bottomley Committed by James Bottomley

[SCSI] Fix oops caused by queue refcounting failure

In certain circumstances, we can get an oops from a torn down device.
Most notably this is from CD roms trying to call scsi_ioctl.  The root
cause of the problem is the fact that after scsi_remove_device() has
been called, the queue is fully torn down.  This is actually wrong
since the queue can be used until the sdev release function is called.
Therefore, we add an extra reference to the queue which is released in
sdev->release, so the queue always exists.
Reported-by: default avatarParag Warudkar <parag.lkml@gmail.com>
Cc: stable@kernel.org
Signed-off-by: default avatarJames Bottomley <jbottomley@parallels.com>
parent 1fa7b6a2
...@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, ...@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
kfree(sdev); kfree(sdev);
goto out; goto out;
} }
blk_get_queue(sdev->request_queue);
sdev->request_queue->queuedata = sdev; sdev->request_queue->queuedata = sdev;
scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun); scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
......
...@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) ...@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
kfree(evt); kfree(evt);
} }
blk_put_queue(sdev->request_queue);
/* NULL queue means the device can't be used */ /* NULL queue means the device can't be used */
sdev->request_queue = NULL; sdev->request_queue = NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment