[PATCH] libata: fix oops caused rescanning NULL sdev

Depending on timing, ata_scsi_dev_rescan() might encounter a device
which is enabled but not yet attached to sdev.  On such cases, the
original code caused oops.  This patch makes ata_scsi_dev_rescan()
rescan only device which are attached to sdevs.

While at it, properly indent leading comment and add description about
how it's synchronized with sdev attach/detach.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

1 files changed, 9 insertions, 8 deletions

diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 45a49be65042..32c1df69091b 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -3005,14 +3005,16 @@ static int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,
 }
 
 /**
- *      ata_scsi_dev_rescan - initiate scsi_rescan_device()
- *      @data: Pointer to ATA port to perform scsi_rescan_device()
+ *      ata_scsi_dev_rescan - initiate scsi_rescan_device()
+ *      @data: Pointer to ATA port to perform scsi_rescan_device()
  *
- *      After ATA pass thru (SAT) commands are executed successfully,
- *      libata need to propagate the changes to SCSI layer.
+ *      After ATA pass thru (SAT) commands are executed successfully,
+ *      libata need to propagate the changes to SCSI layer.  This
+ *      function must be executed from ata_aux_wq such that sdev
+ *      attach/detach don't race with rescan.
  *
- *      LOCKING:
- *      Kernel thread context (may sleep).
+ *      LOCKING:
+ *      Kernel thread context (may sleep).
  */
 void ata_scsi_dev_rescan(void *data)
 {
@@ -3023,8 +3025,7 @@ void ata_scsi_dev_rescan(void *data)
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 dev = &ap->device[i];
 
-                if (ata_dev_enabled(dev))
+                if (ata_dev_enabled(dev) && dev->sdev)
                         scsi_rescan_device(&(dev->sdev->sdev_gendev));
         }
 }
-