block: remove parent device reference from struct bsg_class_device

Bsg holding a reference to the parent device may result in a crash if a
bsg file handle is closed after the parent device driver has unloaded.

Holding a reference is not really needed: the parent device must exist
between bsg_register_queue and bsg_unregister_queue.  Before the device
goes away the caller does blk_cleanup_queue so that all in-flight
requests to the device are gone and all new requests cannot pass beyond
the queue.  The queue itself is a refcounted object and it will stay
alive with a bsg file.

Based on analysis, previous patch and changelog from Anatoliy Glagolev.

Reported-by: Anatoliy Glagolev <glagolig@gmail.com>
Reviewed-by: James E.J. Bottomley <jejb@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/bsg-lib.c b/block/bsg-lib.c
index fc2e5ff2c4b9e81acecbbdad8653bd1b7d888e2b..9419def8c0175591a7a09739b3f8c64e9035357f 100644 (file)
--- a/block/bsg-lib.c
+++ b/block/bsg-lib.c
@@ -303,11 +303,9 @@ static void bsg_exit_rq(struct request_queue *q, struct request *req)
  * @name: device to give bsg device
  * @job_fn: bsg job handler
  * @dd_job_size: size of LLD data needed for each job
- * @release: @dev release function
  */
 struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
-               bsg_job_fn *job_fn, int dd_job_size,
-               void (*release)(struct device *))
+               bsg_job_fn *job_fn, int dd_job_size)
 {
        struct request_queue *q;
        int ret;
@@ -331,7 +329,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
        blk_queue_softirq_done(q, bsg_softirq_done);
        blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT);
 
-       ret = bsg_register_queue(q, dev, name, &bsg_transport_ops, release);
+       ret = bsg_register_queue(q, dev, name, &bsg_transport_ops);
        if (ret) {
                printk(KERN_ERR "%s: bsg interface failed to "
                       "initialize - register queue\n", dev->kobj.name);

diff --git a/block/bsg.c b/block/bsg.c
index 30876c5fbf1560eba2edc45ca59a3a005a2b798c..132e657e2d913ca3fcff87c594de0957d8b6bd97 100644 (file)
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -649,18 +649,6 @@ static struct bsg_device *bsg_alloc_device(void)
        return bd;
 }
 
-static void bsg_kref_release_function(struct kref *kref)
-{
-       struct bsg_class_device *bcd =
-               container_of(kref, struct bsg_class_device, ref);
-       struct device *parent = bcd->parent;
-
-       if (bcd->release)
-               bcd->release(bcd->parent);
-
-       put_device(parent);
-}
-
 static int bsg_put_device(struct bsg_device *bd)
 {
        int ret = 0, do_free;
@@ -693,7 +681,6 @@ static int bsg_put_device(struct bsg_device *bd)
 
        kfree(bd);
 out:
-       kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
        if (do_free)
                blk_put_queue(q);
        return ret;
@@ -759,8 +746,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
         */
        mutex_lock(&bsg_mutex);
        bcd = idr_find(&bsg_minor_idr, iminor(inode));
-       if (bcd)
-               kref_get(&bcd->ref);
        mutex_unlock(&bsg_mutex);
 
        if (!bcd)
@@ -771,8 +756,6 @@ static struct bsg_device *bsg_get_device(struct inode *inode, struct file *file)
                return bd;
 
        bd = bsg_add_device(inode, bcd->queue, file);
-       if (IS_ERR(bd))
-               kref_put(&bcd->ref, bsg_kref_release_function);
 
        return bd;
 }
@@ -912,25 +895,17 @@ void bsg_unregister_queue(struct request_queue *q)
                sysfs_remove_link(&q->kobj, "bsg");
        device_unregister(bcd->class_dev);
        bcd->class_dev = NULL;
-       kref_put(&bcd->ref, bsg_kref_release_function);
        mutex_unlock(&bsg_mutex);
 }
 EXPORT_SYMBOL_GPL(bsg_unregister_queue);
 
 int bsg_register_queue(struct request_queue *q, struct device *parent,
-               const char *name, const struct bsg_ops *ops,
-               void (*release)(struct device *))
+               const char *name, const struct bsg_ops *ops)
 {
        struct bsg_class_device *bcd;
        dev_t dev;
        int ret;
        struct device *class_dev = NULL;
-       const char *devname;
-
-       if (name)
-               devname = name;
-       else
-               devname = dev_name(parent);
 
        /*
         * we need a proper transport to send commands, not a stacked device
@@ -954,15 +929,12 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
 
        bcd->minor = ret;
        bcd->queue = q;
-       bcd->parent = get_device(parent);
-       bcd->release = release;
        bcd->ops = ops;
-       kref_init(&bcd->ref);
        dev = MKDEV(bsg_major, bcd->minor);
-       class_dev = device_create(bsg_class, parent, dev, NULL, "%s", devname);
+       class_dev = device_create(bsg_class, parent, dev, NULL, "%s", name);
        if (IS_ERR(class_dev)) {
                ret = PTR_ERR(class_dev);
-               goto put_dev;
+               goto idr_remove;
        }
        bcd->class_dev = class_dev;
 
@@ -977,8 +949,7 @@ int bsg_register_queue(struct request_queue *q, struct device *parent,
 
 unregister_class_dev:
        device_unregister(class_dev);
-put_dev:
-       put_device(parent);
+idr_remove:
        idr_remove(&bsg_minor_idr, bcd->minor);
 unlock:
        mutex_unlock(&bsg_mutex);
@@ -992,7 +963,7 @@ int bsg_scsi_register_queue(struct request_queue *q, struct device *parent)
                return -EINVAL;
        }
 
-       return bsg_register_queue(q, parent, NULL, &bsg_scsi_ops, NULL);
+       return bsg_register_queue(q, parent, dev_name(parent), &bsg_scsi_ops);
 }
 EXPORT_SYMBOL_GPL(bsg_scsi_register_queue);
 

diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 7a9a65588a1bcfb7de86cb45e500280a74158e13..1da3d71e9f61f784e8131093bd5378d94bb98745 100644 (file)
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3780,8 +3780,7 @@ fc_bsg_hostadd(struct Scsi_Host *shost, struct fc_host_attrs *fc_host)
        snprintf(bsg_name, sizeof(bsg_name),
                 "fc_host%d", shost->host_no);
 
-       q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size,
-                       NULL);
+       q = bsg_setup_queue(dev, bsg_name, fc_bsg_dispatch, i->f->dd_bsg_size);
        if (IS_ERR(q)) {
                dev_err(dev,
                        "fc_host%d: bsg interface failed to initialize - setup queue\n",
@@ -3826,8 +3825,8 @@ fc_bsg_rportadd(struct Scsi_Host *shost, struct fc_rport *rport)
        if (!i->f->bsg_request)
                return -ENOTSUPP;
 
-       q = bsg_setup_queue(dev, NULL, fc_bsg_dispatch, i->f->dd_bsg_size,
-                       NULL);
+       q = bsg_setup_queue(dev, dev_name(dev), fc_bsg_dispatch,
+                       i->f->dd_bsg_size);
        if (IS_ERR(q)) {
                dev_err(dev, "failed to setup bsg queue\n");
                return PTR_ERR(q);

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 65f6c94f2e9b3fa0be7104fa53048a0c61579701..6fd2fe210fc324b2bde0f1a72bd79f2939b3bca9 100644 (file)
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -1542,7 +1542,7 @@ iscsi_bsg_host_add(struct Scsi_Host *shost, struct iscsi_cls_host *ihost)
                return -ENOTSUPP;
 
        snprintf(bsg_name, sizeof(bsg_name), "iscsi_host%d", shost->host_no);
-       q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0, NULL);
+       q = bsg_setup_queue(dev, bsg_name, iscsi_bsg_host_dispatch, 0);
        if (IS_ERR(q)) {
                shost_printk(KERN_ERR, shost, "bsg interface failed to "
                             "initialize - no request queue\n");

diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 08acbabfae07912e125b97e5df3228881b7c9b86..e2953b4167461520c1281b032f92bc8774670b3b 100644 (file)
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -187,16 +187,6 @@ static int sas_smp_dispatch(struct bsg_job *job)
        return 0;
 }
 
-static void sas_host_release(struct device *dev)
-{
-       struct Scsi_Host *shost = dev_to_shost(dev);
-       struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
-       struct request_queue *q = sas_host->q;
-
-       if (q)
-               blk_cleanup_queue(q);
-}
-
 static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
 {
        struct request_queue *q;
@@ -208,7 +198,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
 
        if (rphy) {
                q = bsg_setup_queue(&rphy->dev, dev_name(&rphy->dev),
-                               sas_smp_dispatch, 0, NULL);
+                               sas_smp_dispatch, 0);
                if (IS_ERR(q))
                        return PTR_ERR(q);
                rphy->q = q;
@@ -217,7 +207,7 @@ static int sas_bsg_initialize(struct Scsi_Host *shost, struct sas_rphy *rphy)
 
                snprintf(name, sizeof(name), "sas_host%d", shost->host_no);
                q = bsg_setup_queue(&shost->shost_gendev, name,
-                               sas_smp_dispatch, 0, sas_host_release);
+                               sas_smp_dispatch, 0);
                if (IS_ERR(q))
                        return PTR_ERR(q);
                to_sas_host_attrs(shost)->q = q;
@@ -260,8 +250,11 @@ static int sas_host_remove(struct transport_container *tc, struct device *dev,
        struct Scsi_Host *shost = dev_to_shost(dev);
        struct request_queue *q = to_sas_host_attrs(shost)->q;
 
-       if (q)
+       if (q) {
                bsg_unregister_queue(q);
+               blk_cleanup_queue(q);
+       }
+
        return 0;
 }
 

diff --git a/include/linux/bsg-lib.h b/include/linux/bsg-lib.h
index 28a7ccc55c895444e28a176d4fa18bec6770a24a..6aeaf64726651916d3ffc0768226917fa86f66c2 100644 (file)
--- a/include/linux/bsg-lib.h
+++ b/include/linux/bsg-lib.h
@@ -72,8 +72,7 @@ struct bsg_job {
 void bsg_job_done(struct bsg_job *job, int result,
                  unsigned int reply_payload_rcv_len);
 struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
-               bsg_job_fn *job_fn, int dd_job_size,
-               void (*release)(struct device *));
+               bsg_job_fn *job_fn, int dd_job_size);
 void bsg_job_put(struct bsg_job *job);
 int __must_check bsg_job_get(struct bsg_job *job);
 

diff --git a/include/linux/bsg.h b/include/linux/bsg.h
index 0c7dd9ceb139e53a241d23bb60d1d9591ab480ae..dac37b6e00ecc8a328d5565573ebb8a689740379 100644 (file)
--- a/include/linux/bsg.h
+++ b/include/linux/bsg.h
@@ -17,17 +17,13 @@ struct bsg_ops {
 
 struct bsg_class_device {
        struct device *class_dev;
-       struct device *parent;
        int minor;
        struct request_queue *queue;
-       struct kref ref;
        const struct bsg_ops *ops;
-       void (*release)(struct device *);
 };
 
 int bsg_register_queue(struct request_queue *q, struct device *parent,
-               const char *name, const struct bsg_ops *ops,
-               void (*release)(struct device *));
+               const char *name, const struct bsg_ops *ops);
 int bsg_scsi_register_queue(struct request_queue *q, struct device *parent);
 void bsg_unregister_queue(struct request_queue *q);
 #else