[SCSI] Fix oops caused by queue refcounting failure
authorJames Bottomley <James.Bottomley@HansenPartnership.com>
Wed, 25 May 2011 20:52:14 +0000 (15:52 -0500)
committerJames Bottomley <jbottomley@parallels.com>
Thu, 2 Jun 2011 09:34:43 +0000 (18:34 +0900)
commite73e079bf128d68284efedeba1fbbc18d78610f9
tree7477ba6759346155bb784e9719fe68bab89ee88e
parent1fa7b6a29c61358cc2ca6f64cef4aa0e1a7ca74c
[SCSI] Fix oops caused by queue refcounting failure

In certain circumstances, we can get an oops from a torn down device.
Most notably this is from CD roms trying to call scsi_ioctl.  The root
cause of the problem is the fact that after scsi_remove_device() has
been called, the queue is fully torn down.  This is actually wrong
since the queue can be used until the sdev release function is called.
Therefore, we add an extra reference to the queue which is released in
sdev->release, so the queue always exists.

Reported-by: Parag Warudkar <parag.lkml@gmail.com>
Cc: stable@kernel.org
Signed-off-by: James Bottomley <jbottomley@parallels.com>
drivers/scsi/scsi_scan.c
drivers/scsi/scsi_sysfs.c