Commit 015640ed authored Apr 03, 2009 by FUJITA Tomonori Committed by James Bottomley Apr 03, 2009

[SCSI] sg: fix q->queue_lock on scsi_error_handler path



sg_rq_end_io() is called via rq->end_io. In some rare cases,
sg_rq_end_io calls blk_put_request/blk_rq_unmap_user (when a program
issuing a command has gone before the command completion; e.g. by
interrupting a program issuing a command before the command
completes).

We can't call blk_put_request/blk_rq_unmap_user in interrupt so the
commit c96952ed uses
execute_in_process_context().

The problem is that scsi_error_handler() calls rq->end_io too. We
can't call blk_put_request/blk_rq_unmap_user too in this path (we hold
q->queue_lock).

To avoid the above problem, in these rare cases, this patch always
uses schedule_work() instead of execute_in_process_context().

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

parent 1beb6fa8

drivers/scsi/sg.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -1312,8 +1312,10 @@ static void sg_rq_end_io(struct request *rq, int uptodate)
		wake_up_interruptible(&sfp->read_wait);
		kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
		kref_put(&sfp->f_ref, sg_remove_sfp);
		} else
		execute_in_process_context(sg_rq_end_io_usercontext, &srp->ew);
		} else {
		INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
		schedule_work(&srp->ew.work);
		}
		}

		static struct file_operations sg_fops = {
		@@ -2099,7 +2101,8 @@ static void sg_remove_sfp(struct kref *kref)
		write_unlock_irqrestore(&sg_index_lock, iflags);
		wake_up_interruptible(&sdp->o_excl_wait);

		execute_in_process_context(sg_remove_sfp_usercontext, &sfp->ew);
		INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
		schedule_work(&sfp->ew.work);
		}

		static int