[SCSI] bsg: fix bsg_mutex hang with device removal

We don't need to hold bsg_mutex during bsg_complete_all_commands(). It
leads to a problem that we block bsg_unregister_queue during
bsg_complete_all_commands (untill all the outstanding commands
complete).

Thanks to Pete Wyckoff for finding the bug and testing the patch.

The detailed bug report is:

http://marc.info/?l=linux-scsi&m=121182137132145&w=2

Tested-by: Pete Wyckoff <pw@osc.edu>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

diff --git a/block/bsg.c b/block/bsg.c
index f0b7cd3432160203ea6c650088ccfcd4acf2a3f6..7cdec32205d829abe4be66ec7121d203d1547257 100644 (file)
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -724,8 +724,13 @@ static int bsg_put_device(struct bsg_device *bd)
        mutex_lock(&bsg_mutex);
 
        do_free = atomic_dec_and_test(&bd->ref_count);
-       if (!do_free)
+       if (!do_free) {
+               mutex_unlock(&bsg_mutex);
                goto out;
+       }
+
+       hlist_del(&bd->dev_list);
+       mutex_unlock(&bsg_mutex);
 
        dprintk("%s: tearing down\n", bd->name);
 
@@ -741,10 +746,8 @@ static int bsg_put_device(struct bsg_device *bd)
         */
        ret = bsg_complete_all_commands(bd);
 
-       hlist_del(&bd->dev_list);
        kfree(bd);
 out:
-       mutex_unlock(&bsg_mutex);
        kref_put(&q->bsg_dev.ref, bsg_kref_release_function);
        if (do_free)
                blk_put_queue(q);