5 files changed, 117 insertions, 48 deletions

diff --git a/block/as-iosched.c b/block/as-iosched.c
index 296708ceceb2..e25a5d79ab27 100644
--- a/block/as-iosched.c
+++ b/block/as-iosched.c
@@ -1844,9 +1844,10 @@ static void __exit as_exit(void)
         DECLARE_COMPLETION(all_gone);
         elv_unregister(&iosched_as);
         ioc_gone = &all_gone;
-        barrier();
+        /* ioc_gone's update must be visible before reading ioc_count */
+        smp_wmb();
         if (atomic_read(&ioc_count))
-                complete(ioc_gone);
+                wait_for_completion(ioc_gone);
         synchronize_rcu();
         kmem_cache_destroy(arq_pool);
 }
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 67d446de0227..2540dfaa3e38 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1472,19 +1472,37 @@ out:
         return cfqq;
 }
 
+static void
+cfq_drop_dead_cic(struct io_context *ioc, struct cfq_io_context *cic)
+{
+        read_lock(&cfq_exit_lock);
+        rb_erase(&cic->rb_node, &ioc->cic_root);
+        read_unlock(&cfq_exit_lock);
+        kmem_cache_free(cfq_ioc_pool, cic);
+        atomic_dec(&ioc_count);
+}
+
 static struct cfq_io_context *
 cfq_cic_rb_lookup(struct cfq_data *cfqd, struct io_context *ioc)
 {
-        struct rb_node *n = ioc->cic_root.rb_node;
+        struct rb_node *n;
         struct cfq_io_context *cic;
-        void *key = cfqd;
+        void *k, *key = cfqd;
 
+restart:
+        n = ioc->cic_root.rb_node;
         while (n) {
                 cic = rb_entry(n, struct cfq_io_context, rb_node);
+                /* ->key must be copied to avoid race with cfq_exit_queue() */
+                k = cic->key;
+                if (unlikely(!k)) {
+                        cfq_drop_dead_cic(ioc, cic);
+                        goto restart;
+                }
 
-                if (key < cic->key)
+                if (key < k)
                         n = n->rb_left;
-                else if (key > cic->key)
+                else if (key > k)
                         n = n->rb_right;
                 else
                         return cic;
@@ -1497,29 +1515,37 @@ static inline void
 cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
              struct cfq_io_context *cic)
 {
-        struct rb_node **p = &ioc->cic_root.rb_node;
-        struct rb_node *parent = NULL;
+        struct rb_node **p;
+        struct rb_node *parent;
         struct cfq_io_context *__cic;
-
-        read_lock(&cfq_exit_lock);
+        void *k;
 
         cic->ioc = ioc;
         cic->key = cfqd;
 
         ioc->set_ioprio = cfq_ioc_set_ioprio;
-
+restart:
+        parent = NULL;
+        p = &ioc->cic_root.rb_node;
         while (*p) {
                 parent = *p;
                 __cic = rb_entry(parent, struct cfq_io_context, rb_node);
+                /* ->key must be copied to avoid race with cfq_exit_queue() */
+                k = __cic->key;
+                if (unlikely(!k)) {
+                        cfq_drop_dead_cic(ioc, cic);
+                        goto restart;
+                }
 
-                if (cic->key < __cic->key)
+                if (cic->key < k)
                         p = &(*p)->rb_left;
-                else if (cic->key > __cic->key)
+                else if (cic->key > k)
                         p = &(*p)->rb_right;
                 else
                         BUG();
         }
 
+        read_lock(&cfq_exit_lock);
         rb_link_node(&cic->rb_node, parent, p);
         rb_insert_color(&cic->rb_node, &ioc->cic_root);
         list_add(&cic->queue_list, &cfqd->cic_list);
@@ -2439,9 +2465,10 @@ static void __exit cfq_exit(void)
         DECLARE_COMPLETION(all_gone);
         elv_unregister(&iosched_cfq);
         ioc_gone = &all_gone;
-        barrier();
+        /* ioc_gone's update must be visible before reading ioc_count */
+        smp_wmb();
         if (atomic_read(&ioc_count))
-                complete(ioc_gone);
+                wait_for_completion(ioc_gone);
         synchronize_rcu();
         cfq_slab_kill();
 }
diff --git a/block/elevator.c b/block/elevator.c
index 0d6be03d929e..29825792cbd5 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -895,10 +895,8 @@ ssize_t elv_iosched_show(request_queue_t *q, char *name)
 EXPORT_SYMBOL(elv_dispatch_sort);
 EXPORT_SYMBOL(elv_add_request);
 EXPORT_SYMBOL(__elv_add_request);
-EXPORT_SYMBOL(elv_requeue_request);
 EXPORT_SYMBOL(elv_next_request);
 EXPORT_SYMBOL(elv_dequeue_request);
 EXPORT_SYMBOL(elv_queue_empty);
-EXPORT_SYMBOL(elv_completed_request);
 EXPORT_SYMBOL(elevator_exit);
 EXPORT_SYMBOL(elevator_init);
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index e112d1a5dab6..1755c053fd68 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1554,7 +1554,7 @@ void blk_plug_device(request_queue_t *q)
          * don't plug a stopped queue, it must be paired with blk_start_queue()
          * which will restart the queueing
          */
-        if (test_bit(QUEUE_FLAG_STOPPED, &q->queue_flags))
+        if (blk_queue_stopped(q))
                 return;
 
         if (!test_and_set_bit(QUEUE_FLAG_PLUGGED, &q->queue_flags)) {
@@ -1587,7 +1587,7 @@ EXPORT_SYMBOL(blk_remove_plug);
  */
 void __generic_unplug_device(request_queue_t *q)
 {
-        if (unlikely(test_bit(QUEUE_FLAG_STOPPED, &q->queue_flags)))
+        if (unlikely(blk_queue_stopped(q)))
                 return;
 
         if (!blk_remove_plug(q))
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 24f7af9d0abc..b33eda26e205 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -350,16 +350,51 @@ out:
         return ret;
 }
 
+/**
+ * sg_scsi_ioctl  --  handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl
+ * @file:       file this ioctl operates on (optional)
+ * @q:          request queue to send scsi commands down
+ * @disk:       gendisk to operate on (option)
+ * @sic:        userspace structure describing the command to perform
+ *
+ * Send down the scsi command described by @sic to the device below
+ * the request queue @q.  If @file is non-NULL it's used to perform
+ * fine-grained permission checks that allow users to send down
+ * non-destructive SCSI commands.  If the caller has a struct gendisk
+ * available it should be passed in as @disk to allow the low level
+ * driver to use the information contained in it.  A non-NULL @disk
+ * is only allowed if the caller knows that the low level driver doesn't
+ * need it (e.g. in the scsi subsystem).
+ *
+ * Notes:
+ *   -  This interface is deprecated - users should use the SG_IO
+ *      interface instead, as this is a more flexible approach to
+ *      performing SCSI commands on a device.
+ *   -  The SCSI command length is determined by examining the 1st byte
+ *      of the given command. There is no way to override this.
+ *   -  Data transfers are limited to PAGE_SIZE
+ *   -  The length (x + y) must be at least OMAX_SB_LEN bytes long to
+ *      accommodate the sense buffer when an error occurs.
+ *      The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
+ *      old code will not be surprised.
+ *   -  If a Unix error occurs (e.g. ENOMEM) then the user will receive
+ *      a negative return and the Unix error code in 'errno'.
+ *      If the SCSI command succeeds then 0 is returned.
+ *      Positive numbers returned are the compacted SCSI error codes (4
+ *      bytes in one int) where the lowest byte is the SCSI status.
+ */
 #define OMAX_SB_LEN 16          /* For backward compatibility */
-
-static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
-                         struct gendisk *bd_disk, Scsi_Ioctl_Command __user *sic)
+int sg_scsi_ioctl(struct file *file, struct request_queue *q,
+                  struct gendisk *disk, struct scsi_ioctl_command __user *sic)
 {
         struct request *rq;
         int err;
         unsigned int in_len, out_len, bytes, opcode, cmdlen;
         char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
 
+        if (!sic)
+                return -EINVAL;
+
         /*
          * get in an out lengths, verify they don't exceed a page worth of data
          */
@@ -393,45 +428,53 @@ static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
         if (copy_from_user(rq->cmd, sic->data, cmdlen))
                 goto error;
 
-        if (copy_from_user(buffer, sic->data + cmdlen, in_len))
+        if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
                 goto error;
 
         err = verify_command(file, rq->cmd);
         if (err)
                 goto error;
 
+        /* default.  possible overriden later */
+        rq->retries = 5;
+
         switch (opcode) {
-                case SEND_DIAGNOSTIC:
-                case FORMAT_UNIT:
-                        rq->timeout = FORMAT_UNIT_TIMEOUT;
-                        break;
-                case START_STOP:
-                        rq->timeout = START_STOP_TIMEOUT;
-                        break;
-                case MOVE_MEDIUM:
-                        rq->timeout = MOVE_MEDIUM_TIMEOUT;
-                        break;
-                case READ_ELEMENT_STATUS:
-                        rq->timeout = READ_ELEMENT_STATUS_TIMEOUT;
-                        break;
-                case READ_DEFECT_DATA:
-                        rq->timeout = READ_DEFECT_DATA_TIMEOUT;
-                        break;
-                default:
-                        rq->timeout = BLK_DEFAULT_TIMEOUT;
-                        break;
+        case SEND_DIAGNOSTIC:
+        case FORMAT_UNIT:
+                rq->timeout = FORMAT_UNIT_TIMEOUT;
+                rq->retries = 1;
+                break;
+        case START_STOP:
+                rq->timeout = START_STOP_TIMEOUT;
+                break;
+        case MOVE_MEDIUM:
+                rq->timeout = MOVE_MEDIUM_TIMEOUT;
+                break;
+        case READ_ELEMENT_STATUS:
+                rq->timeout = READ_ELEMENT_STATUS_TIMEOUT;
+                break;
+        case READ_DEFECT_DATA:
+                rq->timeout = READ_DEFECT_DATA_TIMEOUT;
+                rq->retries = 1;
+                break;
+        default:
+                rq->timeout = BLK_DEFAULT_TIMEOUT;
+                break;
+        }
+
+        if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) {
+                err = DRIVER_ERROR << 24;
+                goto out;
         }
 
         memset(sense, 0, sizeof(sense));
         rq->sense = sense;
         rq->sense_len = 0;
-
-        rq->data = buffer;
-        rq->data_len = bytes;
         rq->flags |= REQ_BLOCK_PC;
-        rq->retries = 0;
 
-        blk_execute_rq(q, bd_disk, rq, 0);
+        blk_execute_rq(q, disk, rq, 0);
+
+out:
         err = rq->errors & 0xff;        /* only 8 bit SCSI status */
         if (err) {
                 if (rq->sense_len && rq->sense) {
@@ -450,7 +493,7 @@ error:
         blk_put_request(rq);
         return err;
 }
-
+EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
 
 /* Send basic block requests */
 static int __blk_send_generic(request_queue_t *q, struct gendisk *bd_disk, int cmd, int data)