Re: [PATCH 3/5] scsi: Avoid dangling pointer in scsi_requeue_command()

[Mike Christie <michaelc@xxxxxxxxxxx>]

On 06/29/2012 10:34 AM, Bart Van Assche wrote:
> Reported-by: Mike Christie <michaelc@xxxxxxxxxxx>
> Signed-off-by: Bart Van Assche <bvanassche@xxxxxxx>
> Cc: Tejun Heo <tj@xxxxxxxxxx>
> Cc: James Bottomley <JBottomley@xxxxxxxxxxxxx>
> Cc: <stable@xxxxxxxxxx>
> ---
>   drivers/scsi/scsi_lib.c |    9 +++++++++
>   1 files changed, 9 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
> index 7ebe167..af6357a 100644
> --- a/drivers/scsi/scsi_lib.c
> +++ b/drivers/scsi/scsi_lib.c
> @@ -479,15 +479,24 @@ void scsi_requeue_run_queue(struct work_struct *work)
>    */
>   static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
>   {
> +	struct scsi_device *sdev = cmd->device;
>   	struct request *req = cmd->request;
>   	unsigned long flags;
>
> +	/*
> +	 * We need to hold a reference on the device to avoid that the queue
> +	 * gets killed after the unlock and before scsi_run_queue is invoked.
> +	 */
> +	get_device(&sdev->sdev_gendev);
> +
>   	spin_lock_irqsave(q->queue_lock, flags);
>   	scsi_unprep_request(req);
>   	blk_requeue_request(q, req);
>   	spin_unlock_irqrestore(q->queue_lock, flags);
>
>   	scsi_run_queue(q);
> +
> +	put_device(&sdev->sdev_gendev);
>   }
>
>   void scsi_next_command(struct scsi_cmnd *cmd)

Looks ok to me

Reviewed-by: Mike Christie <michaelc@xxxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html