Commit 70e8d057 authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: core: Revert "Simplify LLD module reference counting" 

Revert the patch series "Call blk_mq_free_tag_set() earlier" because it
introduces a deadlock if the scsi_remove_host() caller holds a reference on
a device, target or host.

Link: https://lore.kernel.org/r/20220821220502.13685-3-bvanassche@acm.org


Fixes: 1a928378 ("scsi: core: Simplify LLD module reference counting")
Reported-by: default avatar <syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com>
Tested-by: default avatarKenneth R. Crudup <kenny@panix.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 2b36209c

drivers/scsi/scsi.c

+3 −6
Original line number Diff line number Diff line
@@ -586,13 +586,10 @@ EXPORT_SYMBOL(scsi_device_get); 
 */

void scsi_device_put(struct scsi_device *sdev)

{

	/*

	 * Decreasing the module reference count before the device reference

	 * count is safe since scsi_remove_host() only returns after all

	 * devices have been removed.

	 */

	module_put(sdev->host->hostt->module);

	struct module *mod = sdev->host->hostt->module;



	put_device(&sdev->sdev_gendev);

	module_put(mod);

}

EXPORT_SYMBOL(scsi_device_put);

drivers/scsi/scsi_sysfs.c

+9 −0
Original line number Diff line number Diff line
@@ -452,6 +452,9 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) 
	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;

	struct scsi_vpd *vpd_pgb0 = NULL, *vpd_pgb1 = NULL, *vpd_pgb2 = NULL;

	unsigned long flags;

	struct module *mod;



	mod = sdev->host->hostt->module;



	scsi_dh_release_device(sdev);
@@ -518,11 +521,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) 


	if (parent)

		put_device(parent);

	module_put(mod);

}



static void scsi_device_dev_release(struct device *dev)

{

	struct scsi_device *sdp = to_scsi_device(dev);



	/* Set module pointer as NULL in case of module unloading */

	if (!try_module_get(sdp->host->hostt->module))

		sdp->host->hostt->module = NULL;



	execute_in_process_context(scsi_device_dev_release_usercontext,

				   &sdp->ew);

}