From 5de815a7eedfacf593817ef34634eaa9b75a1482 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Tue, 29 May 2018 08:40:23 +0200 Subject: block: remove parent device reference from struct bsg_class_device Bsg holding a reference to the parent device may result in a crash if a bsg file handle is closed after the parent device driver has unloaded. Holding a reference is not really needed: the parent device must exist between bsg_register_queue and bsg_unregister_queue. Before the device goes away the caller does blk_cleanup_queue so that all in-flight requests to the device are gone and all new requests cannot pass beyond the queue. The queue itself is a refcounted object and it will stay alive with a bsg file. Based on analysis, previous patch and changelog from Anatoliy Glagolev. Reported-by: Anatoliy Glagolev Reviewed-by: James E.J. Bottomley Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe --- include/linux/bsg.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'include/linux/bsg.h') diff --git a/include/linux/bsg.h b/include/linux/bsg.h index 0c7dd9ceb139..dac37b6e00ec 100644 --- a/include/linux/bsg.h +++ b/include/linux/bsg.h @@ -17,17 +17,13 @@ struct bsg_ops { struct bsg_class_device { struct device *class_dev; - struct device *parent; int minor; struct request_queue *queue; - struct kref ref; const struct bsg_ops *ops; - void (*release)(struct device *); }; int bsg_register_queue(struct request_queue *q, struct device *parent, - const char *name, const struct bsg_ops *ops, - void (*release)(struct device *)); + const char *name, const struct bsg_ops *ops); int bsg_scsi_register_queue(struct request_queue *q, struct device *parent); void bsg_unregister_queue(struct request_queue *q); #else -- cgit v1.2.3