Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756192Ab1EYUwU (ORCPT ); Wed, 25 May 2011 16:52:20 -0400 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:51603 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754304Ab1EYUwS (ORCPT ); Wed, 25 May 2011 16:52:18 -0400 Subject: Re: [PATCH] SCSI IOCTL: Check for device deletion [was Re: __elv_add_request OOPS] From: James Bottomley To: Parag Warudkar Cc: Linus Torvalds , Jens Axboe , "linux-kernel@vger.kernel.org" , "akpm@linux-foundation.org" , Linux SCSI List In-Reply-To: References: <4DDB8BF6.2000304@fusionio.com> <4DDCB1C8.7040708@fusionio.com> <4DDD5240.2060308@fusionio.com> <4DDD55D6.1080909@fusionio.com> Content-Type: text/plain; charset="UTF-8" Date: Wed, 25 May 2011 15:52:14 -0500 Message-ID: <1306356735.1641.61.camel@mulgrave.site> Mime-Version: 1.0 X-Mailer: Evolution 2.32.1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1682 Lines: 49 On Wed, 2011-05-25 at 16:42 -0400, Parag Warudkar wrote: > Yeah - that makes sense. By that logic, looks like we can only disallow > for SDEV_DEL (if we decide to do that check here). I don't think this is the root cause. I think q is non-NULL but has already been released, so we're just getting a NULL deref on the actual list head. Does this fix it? It adds the refcounting at approximately the correct places. Of course, we'll now be trying elevator operations on an extant queue but one whose elevator functions have been destroyed, so there are probably additional state guards to place. James --- diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c index 58584dc..44e8ca3 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c @@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, kfree(sdev); goto out; } - + blk_get_queue(sdev->request_queue); sdev->request_queue->queuedata = sdev; scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun); diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index e639125..e0bd3f7 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) kfree(evt); } + blk_put_queue(sdev->request_queue); /* NULL queue means the device can't be used */ sdev->request_queue = NULL; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/