aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/sd.c
diff options
context:
space:
mode:
authorTejun Heo <tj@kernel.org>2009-02-20 21:04:45 -0500
committerJames Bottomley <James.Bottomley@HansenPartnership.com>2009-02-21 21:29:38 -0500
commit4034cc68157bfa0b6622efe368488d3d3e20f4e6 (patch)
tree525106f6783eeb533df8b1e9feacd7457042d1d9 /drivers/scsi/sd.c
parentb7e7bd34465518f3527bf47a8055f35077d40c6c (diff)
[SCSI] sd: revive sd_index_lock
Commit f27bac2761cab5a2e212dea602d22457a9aa6943 which converted sd to use ida instead of idr incorrectly removed sd_index_lock around id allocation and free. idr/ida do have internal locks but they protect their free object lists not the allocation itself. The caller is responsible for that. This missing synchronization led to the same id being assigned to multiple devices leading to oops. Reported and tracked down by Stuart Hayes of Dell. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Stable Tree <stable@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers/scsi/sd.c')
-rw-r--r--drivers/scsi/sd.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index d57566b8be0a..55310dbc10a6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -107,6 +107,7 @@ static void scsi_disk_release(struct device *cdev);
107static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *); 107static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
108static void sd_print_result(struct scsi_disk *, int); 108static void sd_print_result(struct scsi_disk *, int);
109 109
110static DEFINE_SPINLOCK(sd_index_lock);
110static DEFINE_IDA(sd_index_ida); 111static DEFINE_IDA(sd_index_ida);
111 112
112/* This semaphore is used to mediate the 0->1 reference get in the 113/* This semaphore is used to mediate the 0->1 reference get in the
@@ -1914,7 +1915,9 @@ static int sd_probe(struct device *dev)
1914 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL)) 1915 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
1915 goto out_put; 1916 goto out_put;
1916 1917
1918 spin_lock(&sd_index_lock);
1917 error = ida_get_new(&sd_index_ida, &index); 1919 error = ida_get_new(&sd_index_ida, &index);
1920 spin_unlock(&sd_index_lock);
1918 } while (error == -EAGAIN); 1921 } while (error == -EAGAIN);
1919 1922
1920 if (error) 1923 if (error)
@@ -1936,7 +1939,9 @@ static int sd_probe(struct device *dev)
1936 return 0; 1939 return 0;
1937 1940
1938 out_free_index: 1941 out_free_index:
1942 spin_lock(&sd_index_lock);
1939 ida_remove(&sd_index_ida, index); 1943 ida_remove(&sd_index_ida, index);
1944 spin_unlock(&sd_index_lock);
1940 out_put: 1945 out_put:
1941 put_disk(gd); 1946 put_disk(gd);
1942 out_free: 1947 out_free:
@@ -1986,7 +1991,9 @@ static void scsi_disk_release(struct device *dev)
1986 struct scsi_disk *sdkp = to_scsi_disk(dev); 1991 struct scsi_disk *sdkp = to_scsi_disk(dev);
1987 struct gendisk *disk = sdkp->disk; 1992 struct gendisk *disk = sdkp->disk;
1988 1993
1994 spin_lock(&sd_index_lock);
1989 ida_remove(&sd_index_ida, sdkp->index); 1995 ida_remove(&sd_index_ida, sdkp->index);
1996 spin_unlock(&sd_index_lock);
1990 1997
1991 disk->private_data = NULL; 1998 disk->private_data = NULL;
1992 put_disk(disk); 1999 put_disk(disk);