scsi: scsi_dh_alua: Fix a reference counting bug

The code at the end of alua_rtpg_work() is as follows:

	scsi_device_put(sdev);
	kref_put(&pg->kref, release_port_group);

In other words, alua_rtpg_queue() must hold an sdev reference and a pg
reference before queueing rtpg work. If no rtpg work is queued no
additional references should be held when alua_rtpg_queue() returns. If
no rtpg work is queued, ensure that alua_rtpg_queue() only gives up the
sdev reference if that reference was obtained by the same
alua_rtpg_queue() call.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reported-by: Tang Junhui <tang.junhui@zte.com.cn>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Tang Junhui <tang.junhui@zte.com.cn>
Cc: <stable@vger.kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index f375167f16ea..7bb20684e9fa 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -891,6 +891,7 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 /* Do not queue if the worker is already running */
                 if (!(pg->flags & ALUA_PG_RUNNING)) {
                         kref_get(&pg->kref);
+                        sdev = NULL;
                         start_queue = 1;
                 }
         }
@@ -902,7 +903,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
         if (start_queue &&
             !queue_delayed_work(alua_wq, &pg->rtpg_work,
                                 msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                scsi_device_put(sdev);
+                if (sdev)
+                        scsi_device_put(sdev);
                 kref_put(&pg->kref, release_port_group);
         }
 }