<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">
From: Alan Stern &lt;stern@rowland.harvard.edu&gt;

This is the second of two patches for usb-storage.  I don't think it really
addresses the problem raised by this bug report, but I could be wrong. 
It's closely related, at any rate, and it does fix a real loophole.

Signed-off-by: Alan Stern &lt;stern@rowland.harvard.edu&gt;
Signed-off-by: Andrew Morton &lt;akpm@osdl.org&gt;
---

 drivers/usb/storage/usb.c |   13 +++++++++++++
 1 files changed, 13 insertions(+)

diff -puN drivers/usb/storage/usb.c~fix-something-in-usb drivers/usb/storage/usb.c
--- 25/drivers/usb/storage/usb.c~fix-something-in-usb	Fri Jul  8 16:50:55 2005
+++ 25-akpm/drivers/usb/storage/usb.c	Fri Jul  8 16:50:55 2005
@@ -833,6 +833,19 @@ static void quiesce_and_remove_host(stru
 	/* Wait for the current command to finish, then remove the host */
 	down(&amp;us-&gt;dev_semaphore);
 	up(&amp;us-&gt;dev_semaphore);
+
+	/* queuecommand won't accept any new commands and the control
+	 * thread won't execute a previously-queued command.  If there
+	 * is such a command pending, complete it with an error. */
+	if (us-&gt;srb) {
+		us-&gt;srb-&gt;result = DID_NO_CONNECT &lt;&lt; 16;
+		scsi_lock(us_to_host(us));
+		us-&gt;srb-&gt;scsi_done(us-&gt;srb);
+		us-&gt;srb = NULL;
+		scsi_unlock(us_to_host(us));
+	}
+
+	/* Now we own no commands so it's safe to remove the SCSI host */
 	scsi_remove_host(us_to_host(us));
 }
 
_
</pre></body></html>