[SCSI] fix target scanning oops with fc transport class

We have some nasty issues with 2.6.12-rc6. Any request to scan on
the lpfc or qla2xxx FC adapters will oops. What is happening is the
system is defaulting to non-transport registered targets, which
inherit the parent of the scan. On this second scan, performed by
the attribute, the parent becomes the shost instead of the rport.
The slave functions in the 2 FC adapters use starget_to_rport()
routines, which incorrectly map the shost as an rport pointer.

Additionally, this pointed out other weaknesses:
- If the target structure is torn down outside of the transport,
  we have no method for it to be regenerated at the proper parent.
- We have race conditions on the target being allocated by both
  the midlayer scan (parent=shost) and by the fc transport
  (parent=rport).

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

3 files changed, 42 insertions, 1 deletions

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 2d3c4ac475f2..48edd67982a5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -336,9 +336,23 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
         unsigned long flags;
         const int size = sizeof(struct scsi_target)
                 + shost->transportt->target_size;
-        struct scsi_target *starget = kmalloc(size, GFP_ATOMIC);
+        struct scsi_target *starget;
         struct scsi_target *found_target;
 
+        /*
+         * Obtain the real parent from the transport. The transport
+         * is allowed to fail (no error) if there is nothing at that
+         * target id.
+         */
+        if (shost->transportt->target_parent) {
+                spin_lock_irqsave(shost->host_lock, flags);
+                parent = shost->transportt->target_parent(shost, channel, id);
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                if (!parent)
+                        return NULL;
+        }
+
+        starget = kmalloc(size, GFP_KERNEL);
         if (!starget) {
                 printk(KERN_ERR "%s: allocation failure\n", __FUNCTION__);
                 return NULL;
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 35d1c1e8e345..e6412fce423c 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -1022,6 +1022,23 @@ static int fc_rport_match(struct attribute_container *cont,
         return &i->rport_attr_cont.ac == cont;
 }
 
+
+/*
+ * Must be called with shost->host_lock held
+ */
+static struct device *fc_target_parent(struct Scsi_Host *shost,
+                                        int channel, uint id)
+{
+        struct fc_rport *rport;
+
+        list_for_each_entry(rport, &fc_host_rports(shost), peers)
+                if ((rport->channel == channel) &&
+                    (rport->scsi_target_id == id))
+                        return &rport->dev;
+
+        return NULL;
+}
+
 struct scsi_transport_template *
 fc_attach_transport(struct fc_function_template *ft)
 {
@@ -1057,6 +1074,8 @@ fc_attach_transport(struct fc_function_template *ft)
 
         /* Transport uses the shost workq for scsi scanning */
         i->t.create_work_queue = 1;
+
+        i->t.target_parent = fc_target_parent;
         
         /*
          * Setup SCSI Target Attributes.
diff --git a/include/scsi/scsi_transport.h b/include/scsi/scsi_transport.h
index a4f1837a33b1..f6e0bb484c63 100644
--- a/include/scsi/scsi_transport.h
+++ b/include/scsi/scsi_transport.h
@@ -29,6 +29,14 @@ struct scsi_transport_template {
         struct transport_container target_attrs;
         struct transport_container device_attrs;
 
+        /*
+         * If set, call target_parent prior to allocating a scsi_target,
+         * so we get the appropriate parent for the target. This function
+         * is required for transports like FC and iSCSI that do not put the
+         * scsi_target under scsi_host.
+         */
+        struct device *(*target_parent)(struct Scsi_Host *, int, uint);
+
         /* The size of the specific transport attribute structure (a
          * space of this size will be left at the end of the
          * scsi_* structure */