Alexey Kuznetsov 4e46bf8997 [SCSI] fix crash when disconnecting usb storage
__scsi_remove_device() in scsi_forget_host() is executed out of scan_mutex
and races with scsi_destroy_sdev() <- scsi_sysfs_add_devices() <-
scsi_finish_async_scan().  The result is use after free and/or double
free, oops.

The fix is simple, move scsi_forget_host() under scan_mutex.

scsi_forget_host() is just sequence of __scsi_remove_device().  All
another calls of __scsi_remove_device() are made under scan_mutex.  So
that it is safe.

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
2009-11-26 10:04:22 -06:00
..
2009-03-28 20:30:18 +00:00
2009-11-11 12:21:06 -05:00
2009-06-12 10:02:03 -05:00
2009-08-22 17:52:22 -05:00
2008-01-11 18:22:30 -06:00
2009-05-15 12:23:32 -04:00
2009-05-15 12:24:59 -04:00
2009-05-15 12:24:59 -04:00
2009-04-03 10:17:31 -05:00
2009-04-03 10:17:31 -05:00
2009-04-03 10:17:17 -05:00
2009-04-03 10:17:17 -05:00
2008-10-16 16:52:06 +02:00
2009-08-22 17:51:50 -05:00
2009-10-31 12:11:38 -07:00
2008-12-29 11:24:14 -06:00
2008-08-29 02:13:10 -07:00
2008-10-09 08:56:13 +02:00
2008-12-28 20:00:03 +01:00
2009-06-15 10:09:30 -05:00
2008-01-30 13:14:02 -06:00
2009-09-26 10:17:19 -07:00
2008-01-30 13:14:02 -06:00
2008-10-23 11:42:17 -05:00
2007-07-18 11:16:32 -05:00
2008-07-02 15:06:25 -06:00
2008-02-07 18:02:44 -06:00
2009-01-02 12:02:25 -06:00
2008-10-23 11:42:19 -05:00
2007-10-19 23:22:55 +02:00