Commit bafc8ad8 authored by James Bottomley's avatar James Bottomley

[SCSI] Revert "sg: checking sdp->detached isn't protected when open"

This reverts commit e32c9e63.

This is one of four patches that was causing this bug

[  205.372823] ================================================
[  205.372901] [ BUG: lock held when returning to user space! ]
[  205.372979] 3.12.0-rc6-hw-debug-pagealloc+ #67 Not tainted
[  205.373055] ------------------------------------------------
[  205.373132] megarc.bin/5283 is leaving the kernel with locks still held!
[  205.373212] 1 lock held by megarc.bin/5283:
[  205.373285]  #0:  (&sdp->o_sem){.+.+..}, at: [<ffffffff8161e650>] sg_open+0x3a0/0x4d0

Cc: Vaughan Cao <vaughan.cao@oracle.com>
Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent c0d3b9c2
...@@ -295,20 +295,23 @@ sg_open(struct inode *inode, struct file *filp) ...@@ -295,20 +295,23 @@ sg_open(struct inode *inode, struct file *filp)
if (flags & O_EXCL) if (flags & O_EXCL)
sdp->exclude = 1; /* used by release lock */ sdp->exclude = 1; /* used by release lock */
if (sdp->detached) {
retval = -ENODEV;
goto sem_out;
}
if (sfds_list_empty(sdp)) { /* no existing opens on this device */ if (sfds_list_empty(sdp)) { /* no existing opens on this device */
sdp->sgdebug = 0; sdp->sgdebug = 0;
q = sdp->device->request_queue; q = sdp->device->request_queue;
sdp->sg_tablesize = queue_max_segments(q); sdp->sg_tablesize = queue_max_segments(q);
} }
sfp = sg_add_sfp(sdp, dev); if ((sfp = sg_add_sfp(sdp, dev)))
if (!IS_ERR(sfp))
filp->private_data = sfp; filp->private_data = sfp;
/* retval is already provably zero at this point because of the /* retval is already provably zero at this point because of the
* check after retval = scsi_autopm_get_device(sdp->device)) * check after retval = scsi_autopm_get_device(sdp->device))
*/ */
else { else {
retval = PTR_ERR(sfp); retval = -ENOMEM;
sem_out:
if (flags & O_EXCL) { if (flags & O_EXCL) {
sdp->exclude = 0; /* undo if error */ sdp->exclude = 0; /* undo if error */
up_write(&sdp->o_sem); up_write(&sdp->o_sem);
...@@ -2042,7 +2045,7 @@ sg_add_sfp(Sg_device * sdp, int dev) ...@@ -2042,7 +2045,7 @@ sg_add_sfp(Sg_device * sdp, int dev)
sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN); sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
if (!sfp) if (!sfp)
return ERR_PTR(-ENOMEM); return NULL;
init_waitqueue_head(&sfp->read_wait); init_waitqueue_head(&sfp->read_wait);
rwlock_init(&sfp->rq_list_lock); rwlock_init(&sfp->rq_list_lock);
...@@ -2057,10 +2060,6 @@ sg_add_sfp(Sg_device * sdp, int dev) ...@@ -2057,10 +2060,6 @@ sg_add_sfp(Sg_device * sdp, int dev)
sfp->keep_orphan = SG_DEF_KEEP_ORPHAN; sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
sfp->parentdp = sdp; sfp->parentdp = sdp;
write_lock_irqsave(&sg_index_lock, iflags); write_lock_irqsave(&sg_index_lock, iflags);
if (sdp->detached) {
write_unlock_irqrestore(&sg_index_lock, iflags);
return ERR_PTR(-ENODEV);
}
list_add_tail(&sfp->sfd_siblings, &sdp->sfds); list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
write_unlock_irqrestore(&sg_index_lock, iflags); write_unlock_irqrestore(&sg_index_lock, iflags);
SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp)); SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment