-stable review patch. If anyone has any objections, please let us know.
---------------------
From: FUJITA Tomonori <[email protected]>
upstream commit: 015640edb1f346e0b2eda703587c4cd1c310ec1d
sg_rq_end_io() is called via rq->end_io. In some rare cases,
sg_rq_end_io calls blk_put_request/blk_rq_unmap_user (when a program
issuing a command has gone before the command completion; e.g. by
interrupting a program issuing a command before the command
completes).
We can't call blk_put_request/blk_rq_unmap_user in interrupt so the
commit c96952ed7031e7c576ecf90cf95b8ec099d5295a uses
execute_in_process_context().
The problem is that scsi_error_handler() calls rq->end_io too. We
can't call blk_put_request/blk_rq_unmap_user too in this path (we hold
q->queue_lock).
To avoid the above problem, in these rare cases, this patch always
uses schedule_work() instead of execute_in_process_context().
Signed-off-by: FUJITA Tomonori <[email protected]>
Acked-by: Douglas Gilbert <[email protected]>
Cc: Stable Tree <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
Signed-off-by: Chris Wright <[email protected]>
---
drivers/scsi/sg.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1323,8 +1323,10 @@ static void sg_rq_end_io(struct request
wake_up_interruptible(&sfp->read_wait);
kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
kref_put(&sfp->f_ref, sg_remove_sfp);
- } else
- execute_in_process_context(sg_rq_end_io_usercontext, &srp->ew);
+ } else {
+ INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
+ schedule_work(&srp->ew.work);
+ }
}
static struct file_operations sg_fops = {
@@ -2134,7 +2136,8 @@ static void sg_remove_sfp(struct kref *k
write_unlock_irqrestore(&sg_index_lock, iflags);
wake_up_interruptible(&sdp->o_excl_wait);
- execute_in_process_context(sg_remove_sfp_usercontext, &sfp->ew);
+ INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
+ schedule_work(&sfp->ew.work);
}
static int