scsi: core: Revert "Make sure that targets outlive devices"

Revert the patch series "Call blk_mq_free_tag_set() earlier" because it
introduces a deadlock if the scsi_remove_host() caller holds a reference on
a device, target or host.

Link: https://lore.kernel.org/r/20220821220502.13685-5-bvanassche@acm.org
Fixes: fe442604199e ("scsi: core: Make sure that targets outlive devices")
Reported-by: syzbot+bafeb834708b1bb750bc@syzkaller.appspotmail.com
Tested-by: Kenneth R. Crudup <kenny@panix.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 4c1efd6a3b0ca9d4f5abe56cdae4d5a97e20250b..91ac901a66826ef28fc8e9fded30f98a393e5bf2 100644 (file)
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -521,8 +521,6 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
        starget->state = STARGET_CREATED;
        starget->scsi_level = SCSI_2;
        starget->max_target_blocked = SCSI_DEFAULT_TARGET_BLOCKED;
-       init_waitqueue_head(&starget->sdev_wq);
-
  retry:
        spin_lock_irqsave(shost->host_lock, flags);
 

diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 282b32781e8c2f354bb1f3f4e5100f68840a66d1..aa70d9282161d5be2412531ecacab68c0c82ebcc 100644 (file)
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -443,9 +443,7 @@ static void scsi_device_cls_release(struct device *class_dev)
 
 static void scsi_device_dev_release_usercontext(struct work_struct *work)
 {
-       struct scsi_device *sdev = container_of(work, struct scsi_device,
-                                               ew.work);
-       struct scsi_target *starget = sdev->sdev_target;
+       struct scsi_device *sdev;
        struct device *parent;
        struct list_head *this, *tmp;
        struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
@@ -454,6 +452,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
        unsigned long flags;
        struct module *mod;
 
+       sdev = container_of(work, struct scsi_device, ew.work);
+
        mod = sdev->host->hostt->module;
 
        scsi_dh_release_device(sdev);
@@ -516,9 +516,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
        kfree(sdev->inquiry);
        kfree(sdev);
 
-       if (starget && atomic_dec_return(&starget->sdev_count) == 0)
-               wake_up(&starget->sdev_wq);
-
        if (parent)
                put_device(parent);
        module_put(mod);
@@ -1538,14 +1535,6 @@ static void __scsi_remove_target(struct scsi_target *starget)
                goto restart;
        }
        spin_unlock_irqrestore(shost->host_lock, flags);
-
-       /*
-        * After scsi_remove_target() returns its caller can remove resources
-        * associated with @starget, e.g. an rport or session. Wait until all
-        * devices associated with @starget have been removed to prevent that
-        * a SCSI error handling callback function triggers a use-after-free.
-        */
-       wait_event(starget->sdev_wq, atomic_read(&starget->sdev_count) == 0);
 }
 
 /**
@@ -1656,9 +1645,6 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev)
        list_add_tail(&sdev->same_target_siblings, &starget->devices);
        list_add_tail(&sdev->siblings, &shost->__devices);
        spin_unlock_irqrestore(shost->host_lock, flags);
-
-       atomic_inc(&starget->sdev_count);
-
        /*
         * device can now only be removed via __scsi_remove_device() so hold
         * the target.  Target will be held in CREATED state until something

diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 3113471ca375bb1d05874293d6f17d7aa768e472..2493bd65351a6af6fc4bc6963808ba0c91b24856 100644 (file)
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -309,8 +309,6 @@ struct scsi_target {
        struct list_head        devices;
        struct device           dev;
        struct kref             reap_ref; /* last put renders target invisible */
-       atomic_t                sdev_count;
-       wait_queue_head_t       sdev_wq;
        unsigned int            channel;
        unsigned int            id; /* target id ... replace
                                     * scsi_device.id eventually */