SCSI: Fix oops dereferencing queue

Commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b introduced a regression
where requests could be queued after a device had disappeared.
Subsequent commits have attempted to fix some but not all of these
issues.

Since there appears to be ongoing discussion about the proper way to fix
this we'll partially revert the upstream commit.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: guru.anbalagane <guru.anbalagane@oracle.com>

diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e0bd3f790fca1bf50e4e66e3b2f30f9a130547f3..1d7b605824e8c3e34fbe63bdbd7e9a2f5d7cc245 100644 (file)
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,9 +322,14 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                kfree(evt);
        }
 
-       blk_put_queue(sdev->request_queue);
-       /* NULL queue means the device can't be used */
-       sdev->request_queue = NULL;
+       if (sdev->request_queue) {
+               sdev->request_queue->queuedata = NULL;
+               /* user context needed to free queue */
+               scsi_free_queue(sdev->request_queue);
+               blk_put_queue(sdev->request_queue);
+               /* NULL queue means the device can't be used */
+               sdev->request_queue = NULL;
+       }
 
        scsi_target_reap(scsi_target(sdev));
 
@@ -936,8 +941,6 @@ void __scsi_remove_device(struct scsi_device *sdev)
        /* cause the request function to reject all I/O requests */
        sdev->request_queue->queuedata = NULL;
 
-       /* Freeing the queue signals to block that we're done */
-       scsi_free_queue(sdev->request_queue);
        put_device(dev);
 }