From 49d7bc64283970ee83d2c954d04ba00d04e5943d Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@g5.osdl.org>
Date: Mon, 12 Dec 2005 11:25:04 -0800
Subject: [PATCH] Revert revert of "[SCSI] fix usb storage oops"

This reverts commit 1b0997f561bf46689cc6e0903f342e9bf2506bf1, which in
turn reverted 34ea80ec6a02ad02e6b9c75c478c18e5880d6713 (which is thus
re-instated).

Quoth James Bottomley:

  "All it's doing is deferring the device_put() from the
   scsi_put_command() to after the scsi_run_queue(), which doesn't fix
   the sleep while atomic problem of the device release method.  In both
   cases we still get the semaphore in atomic context problem which is
   caused by scsi_reap_target() doing a device_del(), which I assumed
   (wrongly) was valid from atomic context."

who also promised to fix scsi_reap_target().

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---
 drivers/scsi/scsi_lib.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 4afef5cdcb17..ce9d73a292e2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -542,10 +542,17 @@ static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
 
 void scsi_next_command(struct scsi_cmnd *cmd)
 {
-	struct request_queue *q = cmd->device->request_queue;
+	struct scsi_device *sdev = cmd->device;
+	struct request_queue *q = sdev->request_queue;
+
+	/* need to hold a reference on the device before we let go of the cmd */
+	get_device(&sdev->sdev_gendev);
 
 	scsi_put_command(cmd);
 	scsi_run_queue(q);
+
+	/* ok to remove device now */
+	put_device(&sdev->sdev_gendev);
 }
 
 void scsi_run_host_queues(struct Scsi_Host *shost)