1 files changed, 24 insertions, 2 deletions

diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index bfa569facd5b..1c470e31ae81 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1055,7 +1055,7 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
         struct scsi_device *sdev = scmd->device;
         struct Scsi_Host *shost = sdev->host;
         DECLARE_COMPLETION_ONSTACK(done);
-        unsigned long timeleft = timeout;
+        unsigned long timeleft = timeout, delay;
         struct scsi_eh_save ses;
         const unsigned long stall_for = msecs_to_jiffies(100);
         int rtn;
@@ -1066,7 +1066,29 @@ retry:
 
         scsi_log_send(scmd);
         scmd->scsi_done = scsi_eh_done;
-        rtn = shost->hostt->queuecommand(shost, scmd);
+
+        /*
+         * Lock sdev->state_mutex to avoid that scsi_device_quiesce() can
+         * change the SCSI device state after we have examined it and before
+         * .queuecommand() is called.
+         */
+        mutex_lock(&sdev->state_mutex);
+        while (sdev->sdev_state == SDEV_BLOCK && timeleft > 0) {
+                mutex_unlock(&sdev->state_mutex);
+                SCSI_LOG_ERROR_RECOVERY(5, sdev_printk(KERN_DEBUG, sdev,
+                        "%s: state %d <> %d\n", __func__, sdev->sdev_state,
+                        SDEV_BLOCK));
+                delay = min(timeleft, stall_for);
+                timeleft -= delay;
+                msleep(jiffies_to_msecs(delay));
+                mutex_lock(&sdev->state_mutex);
+        }
+        if (sdev->sdev_state != SDEV_BLOCK)
+                rtn = shost->hostt->queuecommand(shost, scmd);
+        else
+                rtn = SCSI_MLQUEUE_DEVICE_BUSY;
+        mutex_unlock(&sdev->state_mutex);
+
         if (rtn) {
                 if (timeleft > stall_for) {
                         scsi_eh_restore_cmnd(scmd, &ses);