[SCSI] SCSI scanning and removal fixes

This patch (as545) fixes the list traversals in __scsi_remove_target and
scsi_forget_host.  In each case the existing code list_for_each_entry_safe
in an _unsafe_ manner, because the list was not protected from outside
modification while the iteration was running.

The new scsi_forget_host routine takes the moderately controversial step
of iterating over devices for removal rather than iterating over targets.
This makes more sense to me because the current scheme treats targets as
second-class citizens, created and removed on demand, rather than as
objects corresponding to actual hardware.  (Also I couldn't figure out any
safe way to iterate over the target list, since it's not so easy to tell
when a target has already been removed.)

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

2 files changed, 13 insertions, 16 deletions

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index b86f170fa8ed..fcf9f6cbb142 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1466,23 +1466,17 @@ EXPORT_SYMBOL(scsi_scan_single_target);
 
 void scsi_forget_host(struct Scsi_Host *shost)
 {
-        struct scsi_target *starget, *tmp;
+        struct scsi_device *sdev;
         unsigned long flags;
 
-        /*
-         * Ok, this look a bit strange.  We always look for the first device
-         * on the list as scsi_remove_device removes them from it - thus we
-         * also have to release the lock.
-         * We don't need to get another reference to the device before
-         * releasing the lock as we already own the reference from
-         * scsi_register_device that's release in scsi_remove_device.  And
-         * after that we don't look at sdev anymore.
-         */
+ restart:
         spin_lock_irqsave(shost->host_lock, flags);
-        list_for_each_entry_safe(starget, tmp, &shost->__targets, siblings) {
+        list_for_each_entry(sdev, &shost->__devices, siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
-                scsi_remove_target(&starget->dev);
-                spin_lock_irqsave(shost->host_lock, flags);
+                __scsi_remove_device(sdev);
+                goto restart;
         }
         spin_unlock_irqrestore(shost->host_lock, flags);
 }
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 83f87c41b18d..1e47b7eddef4 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -719,17 +719,20 @@ void __scsi_remove_target(struct scsi_target *starget)
 {
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
         unsigned long flags;
-        struct scsi_device *sdev, *tmp;
+        struct scsi_device *sdev;
 
         spin_lock_irqsave(shost->host_lock, flags);
         starget->reap_ref++;
-        list_for_each_entry_safe(sdev, tmp, &shost->__devices, siblings) {
+ restart:
+        list_for_each_entry(sdev, &shost->__devices, siblings) {
                 if (sdev->channel != starget->channel ||
-                    sdev->id != starget->id)
+                    sdev->id != starget->id ||
+                    sdev->sdev_state == SDEV_DEL)
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
                 scsi_remove_device(sdev);
                 spin_lock_irqsave(shost->host_lock, flags);
+                goto restart;
         }
         spin_unlock_irqrestore(shost->host_lock, flags);
         scsi_target_reap(starget);