aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/storage
diff options
context:
space:
mode:
authorMatthew Dharm <mdharm-usb@one-eyed-alien.net>2005-07-28 14:45:50 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2005-09-08 16:22:55 -0700
commit26186ba77b493204ae0fadc3c88a67b14f22168f (patch)
tree6fc0d50a4d286df33b18f21e0994b09637d0c6c8 /drivers/usb/storage
parent77f46328fb83b64befd889ebce6d7fb959932509 (diff)
[PATCH] USB Storage: close a race condition in disconnect near queuecommand
This patch started life as as534, and has been re-diffed against the latest tree. usb-storage has a small loophole, a window between the time queuecommand accepts a new command and the time the control thread starts to execute it. If disconnect is called during that window, the driver won't cancel the pending command -- we've been relying on the SCSI core to cancel it for us during host removal. But it's better for usb-storage to cancel it; this avoids races and reduces reliance on the SCSI core. Fortunately cancelling these commands is easy to do; the key is to do it _before_ calling scsi_remove_host. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/storage')
-rw-r--r--drivers/usb/storage/usb.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 25577115139..97b9ebb8a08 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -833,6 +833,19 @@ static void quiesce_and_remove_host(struct us_data *us)
/* Wait for the current command to finish, then remove the host */
down(&us->dev_semaphore);
up(&us->dev_semaphore);
+
+ /* queuecommand won't accept any new commands and the control
+ * thread won't execute a previously-queued command. If there
+ * is such a command pending, complete it with an error. */
+ if (us->srb) {
+ us->srb->result = DID_NO_CONNECT << 16;
+ scsi_lock(us_to_host(us));
+ us->srb->scsi_done(us->srb);
+ us->srb = NULL;
+ scsi_unlock(us_to_host(us));
+ }
+
+ /* Now we own no commands so it's safe to remove the SCSI host */
scsi_remove_host(us_to_host(us));
}