Patch "scsi: restart list search after unlock in scsi_remove_target" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

scsi: restart list search after unlock in scsi_remove_target

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-restart-list-search-after-unlock-in-scsi_remove_target.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Christoph Hellwig <[email protected]>
Date: Mon, 19 Oct 2015 16:35:46 +0200
Subject: scsi: restart list search after unlock in scsi_remove_target

From: Christoph Hellwig <[email protected]>

commit 40998193560dab6c3ce8d25f4fa58a23e252ef38 upstream.

When dropping a lock while iterating a list we must restart the search as other threads could have manipulated the list under us. Without this we can get stuck in an endless loop. This bug was introduced by

commit bc3f02a795d3b4faa99d37390174be2a75d091bd

Author: Dan Williams <[email protected]>
Date:   Tue Aug 28 22:12:10 2012 -0700

[SCSI] scsi_remove_target: fix softlockup regression on hot remove

Which was itself trying to fix a reported soft lockup issue

http://thread.gmane.org/gmane.linux.kernel/1348679

However, we believe even with this revert of the original patch, the soft lockup problem has been fixed by

commit f2495e228fce9f9cec84367547813cbb0d6db15a

Author: James Bottomley <[email protected]>
Date:   Tue Jan 21 07:01:41 2014 -0800

[SCSI] dual scan thread bug fix

Thanks go to Dan Williams <[email protected]> for tracking all this prior history down.

---
 drivers/scsi/scsi_sysfs.c |   16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

@@ -1030,31 +1030,23 @@ static void __scsi_remove_target(struct
 void scsi_remove_target(struct device *dev)
 {
 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
-	struct scsi_target *starget, *last = NULL;
+	struct scsi_target *starget;
 	unsigned long flags;
 
-	/* remove targets being careful to lookup next entry before
-	 * deleting the last
-	 */
+restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
 		if (starget->state == STARGET_DEL)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
-			/* assuming new targets arrive at the end */
 			kref_get(&starget->reap_ref);
 			spin_unlock_irqrestore(shost->host_lock, flags);
-			if (last)
-				scsi_target_reap(last);
-			last = starget;
 			__scsi_remove_target(starget);
-			spin_lock_irqsave(shost->host_lock, flags);
+			scsi_target_reap(starget);
+			goto restart;
 		}
 	}
 	spin_unlock_irqrestore(shost->host_lock, flags);
-
-	if (last)
-		scsi_target_reap(last);
 }
 EXPORT_SYMBOL(scsi_remove_target);
 

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/scsi-restart-list-search-after-unlock-in-scsi_remove_target.patch queue-3.10/iscsi-target-fix-potential-dead-lock-during-node-acl-delete.patch queue-3.10/fix-a-memory-leak-in-scsi_host_dev_release.patch