mirror of
https://github.com/torvalds/linux
synced 2024-09-16 00:58:07 +00:00
scsi: core: Revert "Make sure that targets outlive devices"
Revert the patch series "Call blk_mq_free_tag_set() earlier" because it
introduces a deadlock if the scsi_remove_host() caller holds a reference on
a device, target or host.
Link: https://lore.kernel.org/r/20220821220502.13685-5-bvanassche@acm.org
Fixes: fe44260419
("scsi: core: Make sure that targets outlive devices")
Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com
Tested-by: Kenneth R. Crudup <kenny@panix.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
d94b2d00f7
commit
f782201ebc
|
@ -521,8 +521,6 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
|
||||||
starget->state = STARGET_CREATED;
|
starget->state = STARGET_CREATED;
|
||||||
starget->scsi_level = SCSI_2;
|
starget->scsi_level = SCSI_2;
|
||||||
starget->max_target_blocked = SCSI_DEFAULT_TARGET_BLOCKED;
|
starget->max_target_blocked = SCSI_DEFAULT_TARGET_BLOCKED;
|
||||||
init_waitqueue_head(&starget->sdev_wq);
|
|
||||||
|
|
||||||
retry:
|
retry:
|
||||||
spin_lock_irqsave(shost->host_lock, flags);
|
spin_lock_irqsave(shost->host_lock, flags);
|
||||||
|
|
||||||
|
|
|
@ -443,9 +443,7 @@ static void scsi_device_cls_release(struct device *class_dev)
|
||||||
|
|
||||||
static void scsi_device_dev_release_usercontext(struct work_struct *work)
|
static void scsi_device_dev_release_usercontext(struct work_struct *work)
|
||||||
{
|
{
|
||||||
struct scsi_device *sdev = container_of(work, struct scsi_device,
|
struct scsi_device *sdev;
|
||||||
ew.work);
|
|
||||||
struct scsi_target *starget = sdev->sdev_target;
|
|
||||||
struct device *parent;
|
struct device *parent;
|
||||||
struct list_head *this, *tmp;
|
struct list_head *this, *tmp;
|
||||||
struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
|
struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
|
||||||
|
@ -454,6 +452,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
struct module *mod;
|
struct module *mod;
|
||||||
|
|
||||||
|
sdev = container_of(work, struct scsi_device, ew.work);
|
||||||
|
|
||||||
mod = sdev->host->hostt->module;
|
mod = sdev->host->hostt->module;
|
||||||
|
|
||||||
scsi_dh_release_device(sdev);
|
scsi_dh_release_device(sdev);
|
||||||
|
@ -516,9 +516,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
|
||||||
kfree(sdev->inquiry);
|
kfree(sdev->inquiry);
|
||||||
kfree(sdev);
|
kfree(sdev);
|
||||||
|
|
||||||
if (starget && atomic_dec_return(&starget->sdev_count) == 0)
|
|
||||||
wake_up(&starget->sdev_wq);
|
|
||||||
|
|
||||||
if (parent)
|
if (parent)
|
||||||
put_device(parent);
|
put_device(parent);
|
||||||
module_put(mod);
|
module_put(mod);
|
||||||
|
@ -1538,14 +1535,6 @@ static void __scsi_remove_target(struct scsi_target *starget)
|
||||||
goto restart;
|
goto restart;
|
||||||
}
|
}
|
||||||
spin_unlock_irqrestore(shost->host_lock, flags);
|
spin_unlock_irqrestore(shost->host_lock, flags);
|
||||||
|
|
||||||
/*
|
|
||||||
* After scsi_remove_target() returns its caller can remove resources
|
|
||||||
* associated with @starget, e.g. an rport or session. Wait until all
|
|
||||||
* devices associated with @starget have been removed to prevent that
|
|
||||||
* a SCSI error handling callback function triggers a use-after-free.
|
|
||||||
*/
|
|
||||||
wait_event(starget->sdev_wq, atomic_read(&starget->sdev_count) == 0);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -1656,9 +1645,6 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev)
|
||||||
list_add_tail(&sdev->same_target_siblings, &starget->devices);
|
list_add_tail(&sdev->same_target_siblings, &starget->devices);
|
||||||
list_add_tail(&sdev->siblings, &shost->__devices);
|
list_add_tail(&sdev->siblings, &shost->__devices);
|
||||||
spin_unlock_irqrestore(shost->host_lock, flags);
|
spin_unlock_irqrestore(shost->host_lock, flags);
|
||||||
|
|
||||||
atomic_inc(&starget->sdev_count);
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* device can now only be removed via __scsi_remove_device() so hold
|
* device can now only be removed via __scsi_remove_device() so hold
|
||||||
* the target. Target will be held in CREATED state until something
|
* the target. Target will be held in CREATED state until something
|
||||||
|
|
|
@ -309,8 +309,6 @@ struct scsi_target {
|
||||||
struct list_head devices;
|
struct list_head devices;
|
||||||
struct device dev;
|
struct device dev;
|
||||||
struct kref reap_ref; /* last put renders target invisible */
|
struct kref reap_ref; /* last put renders target invisible */
|
||||||
atomic_t sdev_count;
|
|
||||||
wait_queue_head_t sdev_wq;
|
|
||||||
unsigned int channel;
|
unsigned int channel;
|
||||||
unsigned int id; /* target id ... replace
|
unsigned int id; /* target id ... replace
|
||||||
* scsi_device.id eventually */
|
* scsi_device.id eventually */
|
||||||
|
|
Loading…
Reference in a new issue