[patch 04/25] SCSI: bsg: fix bsg_mutex hang with device removal

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: <linux-kernel@...>, <stable@...>, FUJITA Tomonori <fujita.tomonori@...>
Cc: Justin Forbes <jmforbes@...>, Zwane Mwaikambo <zwane@...>, Theodore Ts'o <tytso@...>, Randy Dunlap <rdunlap@...>, Dave Jones <davej@...>, Chuck Wolber <chuckw@...>, Chris Wedgwood <reviews@...>, Michael Krufky <mkrufky@...>, Chuck Ebbert <cebbert@...>, Domenico Andreoli <cavokz@...>, Willy Tarreau <w@...>, Rodrigo Rubira Branco <rbranco@...>, Jake Edge <jake@...>, Eugene Teo <eteo@...>, <torvalds@...>, <akpm@...>, <alan@...>, James Bottomley <James.Bottomley@...>, Pete Wyckoff <pw@...>, Oliver Pinter <oliver.pntr@...>
Date: Monday, August 4, 2008 - 5:29 pm

2.6.26-stable review patch.  If anyone has any objections, please let us
know.

------------------

From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>

commit 3f27e3ed11e67c5ee19d560a50eafd93cf8c6682 upstream

[SCSI] bsg: fix bsg_mutex hang with device removal

We don't need to hold bsg_mutex during bsg_complete_all_commands(). It
leads to a problem that we block bsg_unregister_queue during
bsg_complete_all_commands (untill all the outstanding commands
complete).

Thanks to Pete Wyckoff for finding the bug and testing the patch.

The detailed bug report is:

http://marc.info/?l=linux-scsi&m=121182137132145&w=2

Tested-by: Pete Wyckoff <pw@osc.edu>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
CC: Oliver Pinter <oliver.pntr@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 block/bsg.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/block/bsg.c
+++ b/block/bsg.c
@@ -725,8 +725,13 @@ static int bsg_put_device(struct bsg_dev
 	mutex_lock(&bsg_mutex);
 
 	do_free = atomic_dec_and_test(&bd->ref_count);
-	if (!do_free)
+	if (!do_free) {
+		mutex_unlock(&bsg_mutex);
 		goto out;
+	}
+
+	hlist_del(&bd->dev_list);
+	mutex_unlock(&bsg_mutex);
 
 	dprintk("%s: tearing down\n", bd->name);
 
@@ -742,10 +747,8 @@ static int bsg_put_device(struct bsg_dev
 	 */
 	ret = bsg_complete_all_commands(bd);
 
-	hlist_del(&bd->dev_list);
 	kfree(bd);
 out:
-	mutex_unlock(&bsg_mutex);
 	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
 	if (do_free)
 		blk_put_queue(q);

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
[patch 00/25] 2.6.26-stable review, Greg KH, (Mon Aug 4, 5:27 pm)
[patch 25/25] Ath5k: kill tasklets on shutdown, Greg KH, (Mon Aug 4, 5:30 pm)
[patch 24/25] Ath5k: fix memory corruption, Greg KH, (Mon Aug 4, 5:30 pm)
[patch 11/25] SCSI: ch: fix ch_remove oops, Greg KH, (Mon Aug 4, 5:30 pm)
[patch 07/25] Close race in md_probe, Greg KH, (Mon Aug 4, 5:29 pm)
[patch 04/25] SCSI: bsg: fix bsg_mutex hang with device remo..., Greg KH, (Mon Aug 4, 5:29 pm)
Re: [patch 01/25] ftrace: remove unneeded documentation, Steven Rostedt, (Mon Aug 4, 5:42 pm)
Re: [patch 01/25] ftrace: remove unneeded documentation, Steven Rostedt, (Mon Aug 4, 6:02 pm)
Re: [patch 01/25] ftrace: remove unneeded documentation, Steven Rostedt, (Mon Aug 4, 6:16 pm)