[PATCH v4 1/1] scsi: Fix racing between dev init and dev reset

[Bart Van Assche]

On 4/14/22 23:12, Alice Chao wrote:
> diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
> index 0a70aa763a96..abf9a71ed77c 100644
> --- a/drivers/scsi/scsi_lib.c
> +++ b/drivers/scsi/scsi_lib.c
> @@ -2461,6 +2461,7 @@ static void scsi_evt_emit(struct scsi_device *sdev, struct scsi_event *evt)
>   		break;
>   	case SDEV_EVT_POWER_ON_RESET_OCCURRED:
>   		envp[idx++] = "SDEV_UA=POWER_ON_RESET_OCCURRED";
> +		wait_event(sdev->host->host_wait, sdev->sdev_gendev.kobj.parent != NULL);
>   		break;
>   	default:
>   		/* do nothing */
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index f4e6c68ac99e..431f229ac435 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -1904,6 +1904,7 @@ static void do_scsi_scan_host(struct Scsi_Host *shost)
>   	} else {
>   		scsi_scan_host_selected(shost, SCAN_WILD_CARD, SCAN_WILD_CARD,
>   				SCAN_WILD_CARD, 0);
> +		wake_up(&shost->host_wait);
>   	}
>   }

The above patch can only work if scanning a host is followed by a POWER 
ON unit attention. I don't think that is guaranteed. Additionally, what 
will happen with the wait loop if the device generates a POWER on unit 
attention after the device has been removed from its parent? 
kobject_del() clears the parent pointer. device_del() calls 
kobject_del(). scsi_remove_device() calls device_del() before the 
request queue is destroyed.

Thanks,

Bart.