Commit e73e079b authored May 25, 2011 by James Bottomley Committed by James Bottomley Jun 02, 2011

[SCSI] Fix oops caused by queue refcounting failure



In certain circumstances, we can get an oops from a torn down device.
Most notably this is from CD roms trying to call scsi_ioctl.  The root
cause of the problem is the fact that after scsi_remove_device() has
been called, the queue is fully torn down.  This is actually wrong
since the queue can be used until the sdev release function is called.
Therefore, we add an extra reference to the queue which is released in
sdev->release, so the queue always exists.

Reported-by: Parag Warudkar <parag.lkml@gmail.com>
Cc: stable@kernel.org
Signed-off-by: James Bottomley <jbottomley@parallels.com>

parent 1fa7b6a2

drivers/scsi/scsi_scan.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -297,7 +297,7 @@ static struct scsi_device scsi_alloc_sdev(struct scsi_target starget,
		kfree(sdev);
		goto out;
		}

		blk_get_queue(sdev->request_queue);
		sdev->request_queue->queuedata = sdev;
		scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);

drivers/scsi/scsi_sysfs.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
		kfree(evt);
		}

		blk_put_queue(sdev->request_queue);
		/* NULL queue means the device can't be used */
		sdev->request_queue = NULL;

Admin message