From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bl2nam02on0134.outbound.protection.outlook.com ([104.47.38.134]:35168 "EHLO NAM02-BL2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752838AbeBCSBD (ORCPT ); Sat, 3 Feb 2018 13:01:03 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Hannes Reinecke , Hannes Reinecke , "Martin K . Petersen" , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 024/110] scsi: core: check for device state in __scsi_remove_target() Date: Sat, 3 Feb 2018 18:00:39 +0000 Message-ID: <20180203180015.29073-24-alexander.levin@microsoft.com> References: <20180203180015.29073-1-alexander.levin@microsoft.com> In-Reply-To: <20180203180015.29073-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Hannes Reinecke [ Upstream commit 81b6c999897919d5a16fedc018fe375dbab091c5 ] As it turned out device_get() doesn't use kref_get_unless_zero(), so we will be always getting a device pointer. Consequently, we need to check for the device state in __scsi_remove_target() to avoid tripping over deleted objects. Fixes: fbce4d97fd43 ("scsi: fixup kernel warning during rmmod()") Reported-by: Jason Yan Signed-off-by: Hannes Reinecke Reviewed-by: Bart Van Assche Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/scsi_sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index f796bd61f3f0..40406c162d0d 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -1383,7 +1383,10 @@ static void __scsi_remove_target(struct scsi_target = *starget) * check. */ if (sdev->channel !=3D starget->channel || - sdev->id !=3D starget->id || + sdev->id !=3D starget->id) + continue; + if (sdev->sdev_state =3D=3D SDEV_DEL || + sdev->sdev_state =3D=3D SDEV_CANCEL || !get_device(&sdev->sdev_gendev)) continue; spin_unlock_irqrestore(shost->host_lock, flags); --=20 2.11.0