[SCSI] remove a timer race in scsi_queue_insert()

scsi_queue_insert() has four callers.  Three callers call with
timer disabled and one (the second invocation in
scsi_dispatch_cmd()) calls with timer activated.
scsi_queue_insert() used to always call scsi_delete_timer()
and ignore the return value.  This results in race with timer
expiration.  Remove scsi_delete_timer() call from
scsi_queue_insert() and make the caller delete timer and check
the return value.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

1 files changed, 6 insertions, 4 deletions

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 05d2bd075fd4..0d730f646bce 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -638,10 +638,12 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
         }
         spin_unlock_irqrestore(host->host_lock, flags);
         if (rtn) {
-                atomic_inc(&cmd->device->iodone_cnt);
-                scsi_queue_insert(cmd,
-                                (rtn == SCSI_MLQUEUE_DEVICE_BUSY) ?
-                                 rtn : SCSI_MLQUEUE_HOST_BUSY);
+                if (scsi_delete_timer(cmd)) {
+                        atomic_inc(&cmd->device->iodone_cnt);
+                        scsi_queue_insert(cmd,
+                                          (rtn == SCSI_MLQUEUE_DEVICE_BUSY) ?
+                                          rtn : SCSI_MLQUEUE_HOST_BUSY);
+                }
                 SCSI_LOG_MLQUEUE(3,
                     printk("queuecommand : request rejected\n"));
         }