Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f27e3ed authored by FUJITA Tomonori's avatar FUJITA Tomonori Committed by James Bottomley
Browse files

[SCSI] bsg: fix bsg_mutex hang with device removal 

We don't need to hold bsg_mutex during bsg_complete_all_commands(). It
leads to a problem that we block bsg_unregister_queue during
bsg_complete_all_commands (untill all the outstanding commands
complete).

Thanks to Pete Wyckoff for finding the bug and testing the patch.

The detailed bug report is:

http://marc.info/?l=linux-scsi&m=121182137132145&w=2



Tested-by: default avatarPete Wyckoff <pw@osc.edu>
Signed-off-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent 30e9ba9f

block/bsg.c

+6 −3
Original line number Original line Diff line number Diff line
@@ -724,8 +724,13 @@ static int bsg_put_device(struct bsg_device *bd) 
	mutex_lock(&bsg_mutex);

	mutex_lock(&bsg_mutex);





	do_free = atomic_dec_and_test(&bd->ref_count);

	do_free = atomic_dec_and_test(&bd->ref_count);

	if (!do_free)

	if (!do_free) {

		mutex_unlock(&bsg_mutex);

		goto out;

		goto out;

	}



	hlist_del(&bd->dev_list);

	mutex_unlock(&bsg_mutex);





	dprintk("%s: tearing down\n", bd->name);

	dprintk("%s: tearing down\n", bd->name);
@@ -741,10 +746,8 @@ static int bsg_put_device(struct bsg_device *bd) 
	 */

	 */

	ret = bsg_complete_all_commands(bd);

	ret = bsg_complete_all_commands(bd);





	hlist_del(&bd->dev_list);

	kfree(bd);

	kfree(bd);

out:

out:

	mutex_unlock(&bsg_mutex);

	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);

	kref_put(&q->bsg_dev.ref, bsg_kref_release_function);

	if (do_free)

	if (do_free)

		blk_put_queue(q);

		blk_put_queue(q);