[kernel/f15] [SCSI] Fix oops caused by queue refcounting failure

[Dave Jones]

commit 0b2fda5000b7294349276db6e09f0ba4dd92bf4e
Author: Dave Jones <davej at redhat.com>
Date:   Tue Jun 7 15:25:58 2011 -0400

    [SCSI] Fix oops caused by queue refcounting failure

 block-queue-refcount.patch |   43 +++++++++++++++++++++++++++++++++++++++++++
 kernel.spec                |    6 ++++++
 2 files changed, 49 insertions(+), 0 deletions(-)
---
diff --git a/block-queue-refcount.patch b/block-queue-refcount.patch
new file mode 100644
index 0000000..d53dd1b
--- /dev/null
+++ b/block-queue-refcount.patch
@@ -0,0 +1,43 @@
+commit e73e079bf128d68284efedeba1fbbc18d78610f9
+Author: James Bottomley <James.Bottomley at HansenPartnership.com>
+Date:   Wed May 25 15:52:14 2011 -0500
+
+    [SCSI] Fix oops caused by queue refcounting failure
+    
+    In certain circumstances, we can get an oops from a torn down device.
+    Most notably this is from CD roms trying to call scsi_ioctl.  The root
+    cause of the problem is the fact that after scsi_remove_device() has
+    been called, the queue is fully torn down.  This is actually wrong
+    since the queue can be used until the sdev release function is called.
+    Therefore, we add an extra reference to the queue which is released in
+    sdev->release, so the queue always exists.
+    
+    Reported-by: Parag Warudkar <parag.lkml at gmail.com>
+    Cc: stable at kernel.org
+    Signed-off-by: James Bottomley <jbottomley at parallels.com>
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 58584dc..44e8ca3 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
+ 		kfree(sdev);
+ 		goto out;
+ 	}
+-
++	blk_get_queue(sdev->request_queue);
+ 	sdev->request_queue->queuedata = sdev;
+ 	scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
+ 
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index e639125..e0bd3f7 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ 		kfree(evt);
+ 	}
+ 
++	blk_put_queue(sdev->request_queue);
+ 	/* NULL queue means the device can't be used */
+ 	sdev->request_queue = NULL;
+ 
diff --git a/kernel.spec b/kernel.spec
index 204317d..06756f1 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -656,6 +656,8 @@ Patch530: linux-2.6-silence-fbcon-logo.patch
 Patch570: linux-2.6-selinux-mprotect-checks.patch
 Patch580: linux-2.6-sparc-selinux-mprotect-checks.patch
 
+Patch600: block-queue-refcount.patch
+
 Patch610: hda_intel-prealloc-4mb-dmabuffer.patch
 
 Patch700: linux-2.6-e1000-ich9-montevina.patch
@@ -1267,6 +1269,7 @@ ApplyPatch x86-pci-preserve-existing-pci-bfsort-whitelist-for-dell-systems.patch
 #
 # SCSI Bits.
 #
+ApplyPatch block-queue-refcount.patch
 
 # ACPI
 
@@ -1995,6 +1998,9 @@ fi
 # and build.
 
 %changelog
+* Tue Jun 07 2011 Dave Jones <davej at redhat.com>
+- [SCSI] Fix oops caused by queue refcounting failure.
+
 * Sat Jun 04 2011 Chuck Ebbert <cebbert at redhat.com> 2.6.38.8-31
 - Linux 2.6.38.8
 - Revert radeon patches we already have: