tree 2d893c981d17b627bd5d24e5ba4a72418146bb19
parent c7eead1e118fb7e34ee8f5063c3c090c054c3820
author Chris Boot <bootc@bootc.net> 1314045518 +0100
committer Greg Kroah-Hartman <gregkh@suse.de> 1319519416 +0200

firewire: sbp2: fix panic after rmmod with slow targets

commit 0278ccd9d53e07c4e699432b2fed9de6c56f506c upstream.

If firewire-sbp2 starts a login to a target that doesn't complete ORBs
in a timely manner (and has to retry the login), and the module is
removed before the operation times out, you end up with a null-pointer
dereference and a kernel panic.

[SR:  This happens because sbp2_target_get/put() do not maintain
module references.  scsi_device_get/put() do, but at occasions like
Chris describes one, nobody holds a reference to an SBP-2 sdev.]

This patch cancels pending work for each unit in sbp2_remove(), which
hopefully means there are no extra references around that prevent us
from unloading. This fixes my crash.

Signed-off-by: Chris Boot <bootc@bootc.net>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>