Q: Given the following code slice:
```
1 struct lpfc_nodelist *
2 lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did)
3 {
4 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
5 	struct lpfc_nodelist *ndlp;
6 	unsigned long iflags;
7 
8 	spin_lock_irqsave(shost->host_lock, iflags);
9 	ndlp = __lpfc_findnode_did(vport, did);
10 	spin_unlock_irqrestore(shost->host_lock, iflags);
11 	return ndlp;
12 }
13 int scsi_autopm_get_host(struct Scsi_Host *shost)
14 {
15 	int	err;
16 
17 	err = pm_runtime_get_sync(&shost->shost_gendev);
18 	if (err < 0 && err !=-EACCES)
19 		pm_runtime_put_sync(&shost->shost_gendev);
20 	else
21 		err = 0;
22 	return err;
23 }
24 static void device_remove_attrs(struct device *dev)
25 {
26 	struct class *class = dev->class;
27 	const struct device_type *type = dev->type;
28 
29 	if (dev->physical_location) {
30 		device_remove_group(dev, &dev_attr_physical_location_group);
31 		kfree(dev->physical_location);
32 	}
33 
34 	device_remove_file(dev, &dev_attr_removable);
35 	device_remove_file(dev, &dev_attr_waiting_for_supplier);
36 	device_remove_file(dev, &dev_attr_online);
37 	device_remove_groups(dev, dev->groups);
38 
39 	if (type)
40 		device_remove_groups(dev, type->groups);
41 
42 	if (class)
43 		device_remove_groups(dev, class->dev_groups);
44 }
45 static inline void __list_del_entry(struct list_head *entry)
46 {
47 	__list_del(entry->prev, entry->next);
48 }
49 static inline void might_sleep(void)
50 {
51 	BUG_ON(preempt_disable_count);
52 }
53 void drain_workqueue(struct workqueue_struct *wq)
54 {
55 	unsigned int flush_cnt = 0;
56 	struct pool_workqueue *pwq;
57 
58 	/*
59 	 * __queue_work() needs to test whether there are drainers, is much
60 	 * hotter than drain_workqueue() and already looks at @wq->flags.
61 	 * Use __WQ_DRAINING so that queue doesn't have to check nr_drainers.
62 	 */
63 	mutex_lock(&wq->mutex);
64 	if (!wq->nr_drainers++)
65 		wq->flags |= __WQ_DRAINING;
66 	mutex_unlock(&wq->mutex);
67 reflush:
68 	__flush_workqueue(wq);
69 
70 	mutex_lock(&wq->mutex);
71 
72 	for_each_pwq(pwq, wq) {
73 		bool drained;
74 
75 		raw_spin_lock_irq(&pwq->pool->lock);
76 		drained = !pwq->nr_active && list_empty(&pwq->inactive_works);
77 		raw_spin_unlock_irq(&pwq->pool->lock);
78 
79 		if (drained)
80 			continue;
81 
82 		if (++flush_cnt == 10 ||
83 		    (flush_cnt % 100 == 0 && flush_cnt <= 1000))
84 			pr_warn("workqueue %s: %s() isn't complete after %u tries\n",
85 				wq->name, __func__, flush_cnt);
86 
87 		mutex_unlock(&wq->mutex);
88 		goto reflush;
89 	}
90 
91 	if (!--wq->nr_drainers)
92 		wq->flags &= ~__WQ_DRAINING;
93 	mutex_unlock(&wq->mutex);
94 }
95 static inline unsigned int memalloc_noio_save(void)
96 {
97 	unsigned int flags = current->flags & PF_MEMALLOC_NOIO;
98 	current->flags |= PF_MEMALLOC_NOIO;
99 	return flags;
100 }
101 static inline int kernfs_remove_by_name(struct kernfs_node *parent,
102 					const char *name)
103 {
104 	return kernfs_remove_by_name_ns(parent, name, NULL);
105 }
106 void __sched mutex_lock(struct mutex *lock)
107 {
108 	might_sleep();
109 
110 	if (!__mutex_trylock_fast(lock))
111 		__mutex_lock_slowpath(lock);
112 }
113 static inline struct kobject *get_glue_dir(struct device *dev)
114 {
115 	return dev->kobj.parent;
116 }
117 static long __sched
118 wait_for_common(struct completion *x, long timeout, int state)
119 {
120 	return __wait_for_common(x, schedule_timeout, timeout, state);
121 }
122 void show_one_workqueue(struct workqueue_struct *wq)
123 {
124 	struct pool_workqueue *pwq;
125 	bool idle = true;
126 	unsigned long flags;
127 
128 	for_each_pwq(pwq, wq) {
129 		if (pwq->nr_active || !list_empty(&pwq->inactive_works)) {
130 			idle = false;
131 			break;
132 		}
133 	}
134 	if (idle) /* Nothing to print for idle workqueue */
135 		return;
136 
137 	pr_info("workqueue %s: flags=0x%x\n", wq->name, wq->flags);
138 
139 	for_each_pwq(pwq, wq) {
140 		raw_spin_lock_irqsave(&pwq->pool->lock, flags);
141 		if (pwq->nr_active || !list_empty(&pwq->inactive_works)) {
142 			/*
143 			 * Defer printing to avoid deadlocks in console
144 			 * drivers that queue work while holding locks
145 			 * also taken in their write paths.
146 			 */
147 			printk_deferred_enter();
148 			show_pwq(pwq);
149 			printk_deferred_exit();
150 		}
151 		raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
152 		/*
153 		 * We could be printing a lot from atomic context, e.g.
154 		 * sysrq-t -> show_all_workqueues(). Avoid triggering
155 		 * hard lockup.
156 		 */
157 		touch_nmi_watchdog();
158 	}
159 
160 }
161 void __sched wait_for_completion(struct completion *x)
162 {
163 	wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_UNINTERRUPTIBLE);
164 }
165 void __scsi_remove_device(struct scsi_device *sdev)
166 {
167 	struct device *dev = &sdev->sdev_gendev;
168 	int res;
169 
170 	/*
171 	 * This cleanup path is not reentrant and while it is impossible
172 	 * to get a new reference with scsi_device_get() someone can still
173 	 * hold a previously acquired one.
174 	 */
175 	if (sdev->sdev_state == SDEV_DEL)
176 		return;
177 
178 	if (sdev->is_visible) {
179 		/*
180 		 * If scsi_internal_target_block() is running concurrently,
181 		 * wait until it has finished before changing the device state.
182 		 */
183 		mutex_lock(&sdev->state_mutex);
184 		/*
185 		 * If blocked, we go straight to DEL and restart the queue so
186 		 * any commands issued during driver shutdown (like sync
187 		 * cache) are errored immediately.
188 		 */
189 		res = scsi_device_set_state(sdev, SDEV_CANCEL);
190 		if (res != 0) {
191 			res = scsi_device_set_state(sdev, SDEV_DEL);
192 			if (res == 0)
193 				scsi_start_queue(sdev);
194 		}
195 		mutex_unlock(&sdev->state_mutex);
196 
197 		if (res != 0)
198 			return;
199 
200 		if (IS_ENABLED(CONFIG_BLK_DEV_BSG) && sdev->bsg_dev)
201 			bsg_unregister_queue(sdev->bsg_dev);
202 		device_unregister(&sdev->sdev_dev);
203 		transport_remove_device(dev);
204 		device_del(dev);
205 	} else
206 		put_device(&sdev->sdev_dev);
207 
208 	/*
209 	 * Stop accepting new requests and wait until all queuecommand() and
210 	 * scsi_run_queue() invocations have finished before tearing down the
211 	 * device.
212 	 */
213 	mutex_lock(&sdev->state_mutex);
214 	scsi_device_set_state(sdev, SDEV_DEL);
215 	mutex_unlock(&sdev->state_mutex);
216 
217 	blk_mq_destroy_queue(sdev->request_queue);
218 	kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags);
219 	cancel_work_sync(&sdev->requeue_work);
220 
221 	if (sdev->host->hostt->slave_destroy)
222 		sdev->host->hostt->slave_destroy(sdev);
223 	transport_destroy_device(dev);
224 
225 	/*
226 	 * Paired with the kref_get() in scsi_sysfs_initialize().  We have
227 	 * removed sysfs visibility from the device, so make the target
228 	 * invisible if this was the last device underneath it.
229 	 */
230 	scsi_target_reap(scsi_target(sdev));
231 
232 	put_device(dev);
233 }
234 static inline void device_lock(struct device *dev)
235 {
236 	mutex_lock(&dev->mutex);
237 }
238 struct device *get_device(struct device *dev)
239 {
240 	return dev ? kobj_to_dev(kobject_get(&dev->kobj)) : NULL;
241 }
242 void kobject_del(struct kobject *kobj)
243 {
244 	struct kobject *parent;
245 
246 	if (!kobj)
247 		return;
248 
249 	parent = kobj->parent;
250 	__kobject_del(kobj);
251 	kobject_put(parent);
252 }
253 int scsi_host_set_state(struct Scsi_Host *shost, enum scsi_host_state state)
254 {
255 	enum scsi_host_state oldstate = shost->shost_state;
256 
257 	if (state == oldstate)
258 		return 0;
259 
260 	switch (state) {
261 	case SHOST_CREATED:
262 		/* There are no legal states that come back to
263 		 * created.  This is the manually initialised start
264 		 * state */
265 		goto illegal;
266 
267 	case SHOST_RUNNING:
268 		switch (oldstate) {
269 		case SHOST_CREATED:
270 		case SHOST_RECOVERY:
271 			break;
272 		default:
273 			goto illegal;
274 		}
275 		break;
276 
277 	case SHOST_RECOVERY:
278 		switch (oldstate) {
279 		case SHOST_RUNNING:
280 			break;
281 		default:
282 			goto illegal;
283 		}
284 		break;
285 
286 	case SHOST_CANCEL:
287 		switch (oldstate) {
288 		case SHOST_CREATED:
289 		case SHOST_RUNNING:
290 		case SHOST_CANCEL_RECOVERY:
291 			break;
292 		default:
293 			goto illegal;
294 		}
295 		break;
296 
297 	case SHOST_DEL:
298 		switch (oldstate) {
299 		case SHOST_CANCEL:
300 		case SHOST_DEL_RECOVERY:
301 			break;
302 		default:
303 			goto illegal;
304 		}
305 		break;
306 
307 	case SHOST_CANCEL_RECOVERY:
308 		switch (oldstate) {
309 		case SHOST_CANCEL:
310 		case SHOST_RECOVERY:
311 			break;
312 		default:
313 			goto illegal;
314 		}
315 		break;
316 
317 	case SHOST_DEL_RECOVERY:
318 		switch (oldstate) {
319 		case SHOST_CANCEL_RECOVERY:
320 			break;
321 		default:
322 			goto illegal;
323 		}
324 		break;
325 	}
326 	shost->shost_state = state;
327 	return 0;
328 
329  illegal:
330 	SCSI_LOG_ERROR_RECOVERY(1,
331 				shost_printk(KERN_ERR, shost,
332 					     "Illegal host state transition"
333 					     "%s->%s\n",
334 					     scsi_host_state_name(oldstate),
335 					     scsi_host_state_name(state)));
336 	return -EINVAL;
337 }
338 void
339 lpfc_free_sysfs_attr(struct lpfc_vport *vport)
340 {
341 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
342 
343 	/* Virtual ports do not need ctrl_reg and mbox */
344 	if (vport->port_type == LPFC_NPIV_PORT)
345 		return;
346 	sysfs_remove_bin_file(&shost->shost_dev.kobj, &sysfs_mbox_attr);
347 	sysfs_remove_bin_file(&shost->shost_dev.kobj, &sysfs_ctlreg_attr);
348 }
349 const char *scsi_host_state_name(enum scsi_host_state state)
350 {
351 	int i;
352 	char *name = NULL;
353 
354 	for (i = 0; i < ARRAY_SIZE(shost_states); i++) {
355 		if (shost_states[i].value == state) {
356 			name = shost_states[i].name;
357 			break;
358 		}
359 	}
360 	return name;
361 }
362 int devres_release_all(struct device *dev)
363 {
364 	unsigned long flags;
365 	LIST_HEAD(todo);
366 	int cnt;
367 
368 	/* Looks like an uninitialized device structure */
369 	if (WARN_ON(dev->devres_head.next == NULL))
370 		return -ENODEV;
371 
372 	/* Nothing to release if list is empty */
373 	if (list_empty(&dev->devres_head))
374 		return 0;
375 
376 	spin_lock_irqsave(&dev->devres_lock, flags);
377 	cnt = remove_nodes(dev, dev->devres_head.next, &dev->devres_head, &todo);
378 	spin_unlock_irqrestore(&dev->devres_lock, flags);
379 
380 	release_nodes(dev, &todo);
381 	return cnt;
382 }
383 int devtmpfs_delete_node(struct device *dev)
384 {
385 	const char *tmp = NULL;
386 	struct req req;
387 
388 	if (!thread)
389 		return 0;
390 
391 	req.name = device_get_devnode(dev, NULL, NULL, NULL, &tmp);
392 	if (!req.name)
393 		return -ENOMEM;
394 
395 	req.mode = 0;
396 	req.dev = dev;
397 
398 	return devtmpfs_submit_req(&req, tmp);
399 }
400 struct lpfc_nodelist *
401 lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did)
402 {
403 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
404 	struct lpfc_nodelist *ndlp;
405 	unsigned long iflags;
406 
407 	spin_lock_irqsave(shost->host_lock, iflags);
408 	ndlp = __lpfc_findnode_did(vport, did);
409 	spin_unlock_irqrestore(shost->host_lock, iflags);
410 	return ndlp;
411 }
412 static bool pwq_busy(struct pool_workqueue *pwq)
413 {
414 	int i;
415 
416 	for (i = 0; i < WORK_NR_COLORS; i++)
417 		if (pwq->nr_in_flight[i])
418 			return true;
419 
420 	if ((pwq != pwq->wq->dfl_pwq) && (pwq->refcnt > 1))
421 		return true;
422 	if (pwq->nr_active || !list_empty(&pwq->inactive_works))
423 		return true;
424 
425 	return false;
426 }
427 void __sched mutex_unlock(struct mutex *lock)
428 {
429 	mutex_release(&lock->dep_map, _RET_IP_);
430 	__rt_mutex_unlock(&lock->rtmutex);
431 }
432 static inline void spin_unlock(spinlock_t *lock)
433 {
434 	int ret = pthread_spin_unlock(lock);
435 	assert(!ret);
436 }
437 void dpm_sysfs_remove(struct device *dev)
438 {
439 	if (device_pm_not_required(dev))
440 		return;
441 	sysfs_unmerge_group(&dev->kobj, &pm_qos_latency_tolerance_attr_group);
442 	dev_pm_qos_constraints_destroy(dev);
443 	rpm_sysfs_remove(dev);
444 	sysfs_unmerge_group(&dev->kobj, &pm_wakeup_attr_group);
445 	sysfs_remove_group(&dev->kobj, &pm_attr_group);
446 }
447 void scsi_proc_hostdir_rm(struct scsi_host_template *sht)
448 {
449 	if (!sht->show_info)
450 		return;
451 
452 	mutex_lock(&global_host_template_mutex);
453 	if (!--sht->present && sht->proc_dir) {
454 		remove_proc_entry(sht->proc_name, proc_scsi);
455 		sht->proc_dir = NULL;
456 	}
457 	mutex_unlock(&global_host_template_mutex);
458 }
459 void scsi_proc_host_rm(struct Scsi_Host *shost)
460 {
461 	char name[10];
462 
463 	if (!shost->hostt->proc_dir)
464 		return;
465 
466 	sprintf(name,"%d", shost->host_no);
467 	remove_proc_entry(name, shost->hostt->proc_dir);
468 }
469 static inline void memalloc_noio_restore(unsigned int flags)
470 {
471 	current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags;
472 }
473 void msleep(unsigned int msecs)
474 {
475 	unsigned long timeout = msecs_to_jiffies(msecs) + 1;
476 
477 	while (timeout)
478 		timeout = schedule_timeout_uninterruptible(timeout);
479 }
480 void device_unregister(struct device *dev)
481 {
482 	pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
483 	device_del(dev);
484 	put_device(dev);
485 }
486 bool kill_device(struct device *dev)
487 {
488 	/*
489 	 * Require the device lock and set the "dead" flag to guarantee that
490 	 * the update behavior is consistent with the other bitfields near
491 	 * it and that we cannot have an asynchronous probe routine trying
492 	 * to run while we are tearing out the bus/class/sysfs from
493 	 * underneath the device.
494 	 */
495 	device_lock_assert(dev);
496 
497 	if (dev->p->dead)
498 		return false;
499 	dev->p->dead = true;
500 	return true;
501 }
502 int lpfc_vport_delete(struct fc_vport *fc_vport)
503 {
504 	struct lpfc_nodelist *ndlp = NULL;
505 	struct lpfc_vport *vport = *(struct lpfc_vport **)fc_vport->dd_data;
506 	struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
507 	struct lpfc_hba  *phba = vport->phba;
508 	int rc;
509 
510 	if (vport->port_type == LPFC_PHYSICAL_PORT) {
511 		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
512 				 "1812 vport_delete failed: Cannot delete "
513 				 "physical host\n");
514 		return VPORT_ERROR;
515 	}
516 
517 	/* If the vport is a static vport fail the deletion. */
518 	if ((vport->vport_flag & STATIC_VPORT) &&
519 		!(phba->pport->load_flag & FC_UNLOADING)) {
520 		lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
521 				 "1837 vport_delete failed: Cannot delete "
522 				 "static vport.\n");
523 		return VPORT_ERROR;
524 	}
525 
526 	spin_lock_irq(&phba->hbalock);
527 	vport->load_flag |= FC_UNLOADING;
528 	spin_unlock_irq(&phba->hbalock);
529 
530 	/*
531 	 * If we are not unloading the driver then prevent the vport_delete
532 	 * from happening until after this vport's discovery is finished.
533 	 */
534 	if (!(phba->pport->load_flag & FC_UNLOADING)) {
535 		int check_count = 0;
536 		while (check_count < ((phba->fc_ratov * 3) + 3) &&
537 		       vport->port_state > LPFC_VPORT_FAILED &&
538 		       vport->port_state < LPFC_VPORT_READY) {
539 			check_count++;
540 			msleep(1000);
541 		}
542 		if (vport->port_state > LPFC_VPORT_FAILED &&
543 		    vport->port_state < LPFC_VPORT_READY)
544 			return -EAGAIN;
545 	}
546 
547 	/*
548 	 * Take early refcount for outstanding I/O requests we schedule during
549 	 * delete processing for unreg_vpi.  Always keep this before
550 	 * scsi_remove_host() as we can no longer obtain a reference through
551 	 * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
552 	 */
553 	if (!scsi_host_get(shost))
554 		return VPORT_INVAL;
555 
556 	lpfc_free_sysfs_attr(vport);
557 	lpfc_debugfs_terminate(vport);
558 
559 	/* Remove FC host to break driver binding. */
560 	fc_remove_host(shost);
561 	scsi_remove_host(shost);
562 
563 	/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */
564 	ndlp = lpfc_findnode_did(vport, Fabric_DID);
565 	if (!ndlp)
566 		goto skip_logo;
567 
568 	if (ndlp && ndlp->nlp_state == NLP_STE_UNMAPPED_NODE &&
569 	    phba->link_state >= LPFC_LINK_UP &&
570 	    phba->fc_topology != LPFC_TOPOLOGY_LOOP) {
571 		if (vport->cfg_enable_da_id) {
572 			/* Send DA_ID and wait for a completion. */
573 			rc = lpfc_ns_cmd(vport, SLI_CTNS_DA_ID, 0, 0);
574 			if (rc) {
575 				lpfc_printf_log(vport->phba, KERN_WARNING,
576 						LOG_VPORT,
577 						"1829 CT command failed to "
578 						"delete objects on fabric, "
579 						"rc %d\n", rc);
580 			}
581 		}
582 
583 		/*
584 		 * If the vpi is not registered, then a valid FDISC doesn't
585 		 * exist and there is no need for a ELS LOGO.  Just cleanup
586 		 * the ndlp.
587 		 */
588 		if (!(vport->vpi_state & LPFC_VPI_REGISTERED))
589 			goto skip_logo;
590 
591 		/* Issue a Fabric LOGO to cleanup fabric resources. */
592 		ndlp = lpfc_findnode_did(vport, Fabric_DID);
593 		if (!ndlp)
594 			goto skip_logo;
595 
596 		rc = lpfc_send_npiv_logo(vport, ndlp);
597 		if (rc)
598 			goto skip_logo;
599 	}
600 
601 	if (!(phba->pport->load_flag & FC_UNLOADING))
602 		lpfc_discovery_wait(vport);
603 
604 skip_logo:
605 
606 	lpfc_cleanup(vport);
607 
608 	/* Remove scsi host now.  The nodes are cleaned up. */
609 	lpfc_sli_host_down(vport);
610 	lpfc_stop_vport_timers(vport);
611 
612 	if (!(phba->pport->load_flag & FC_UNLOADING)) {
613 		lpfc_unreg_all_rpis(vport);
614 		lpfc_unreg_default_rpis(vport);
615 		/*
616 		 * Completion of unreg_vpi (lpfc_mbx_cmpl_unreg_vpi)
617 		 * does the scsi_host_put() to release the vport.
618 		 */
619 		if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
620 				lpfc_mbx_unreg_vpi(vport))
621 			scsi_host_put(shost);
622 	} else {
623 		scsi_host_put(shost);
624 	}
625 
626 	lpfc_free_vpi(phba, vport->vpi);
627 	vport->work_port_events = 0;
628 	spin_lock_irq(&phba->port_list_lock);
629 	list_del_init(&vport->listentry);
630 	spin_unlock_irq(&phba->port_list_lock);
631 	lpfc_printf_vlog(vport, KERN_ERR, LOG_VPORT,
632 			 "1828 Vport Deleted.\n");
633 	scsi_host_put(shost);
634 	return VPORT_OK;
635 }
636 void transport_remove_device(struct device *dev)
637 {
638 	attribute_container_device_trigger(dev, transport_remove_classdev);
639 }
640 bool refcount_dec_and_test(refcount_t *r)
641 {
642 	return refcount_sub_and_test(1, r);
643 }
644 void
645 fc_remove_host(struct Scsi_Host *shost)
646 {
647 	struct fc_vport *vport = NULL, *next_vport = NULL;
648 	struct fc_rport *rport = NULL, *next_rport = NULL;
649 	struct workqueue_struct *work_q;
650 	struct fc_host_attrs *fc_host = shost_to_fc_host(shost);
651 	unsigned long flags;
652 
653 	spin_lock_irqsave(shost->host_lock, flags);
654 
655 	/* Remove any vports */
656 	list_for_each_entry_safe(vport, next_vport, &fc_host->vports, peers) {
657 		vport->flags |= FC_VPORT_DELETING;
658 		fc_queue_work(shost, &vport->vport_delete_work);
659 	}
660 
661 	/* Remove any remote ports */
662 	list_for_each_entry_safe(rport, next_rport,
663 			&fc_host->rports, peers) {
664 		list_del(&rport->peers);
665 		rport->port_state = FC_PORTSTATE_DELETED;
666 		fc_queue_work(shost, &rport->rport_delete_work);
667 	}
668 
669 	list_for_each_entry_safe(rport, next_rport,
670 			&fc_host->rport_bindings, peers) {
671 		list_del(&rport->peers);
672 		rport->port_state = FC_PORTSTATE_DELETED;
673 		fc_queue_work(shost, &rport->rport_delete_work);
674 	}
675 
676 	spin_unlock_irqrestore(shost->host_lock, flags);
677 
678 	/* flush all scan work items */
679 	scsi_flush_work(shost);
680 
681 	/* flush all stgt delete, and rport delete work items, then kill it  */
682 	if (fc_host->work_q) {
683 		work_q = fc_host->work_q;
684 		fc_host->work_q = NULL;
685 		destroy_workqueue(work_q);
686 	}
687 
688 	/* flush all devloss work items, then kill it  */
689 	if (fc_host->devloss_work_q) {
690 		work_q = fc_host->devloss_work_q;
691 		fc_host->devloss_work_q = NULL;
692 		destroy_workqueue(work_q);
693 	}
694 }
695 static inline struct Scsi_Host *
696 lpfc_shost_from_vport(struct lpfc_vport *vport)
697 {
698 	return container_of((void *) vport, struct Scsi_Host, hostdata[0]);
699 }
700 void device_remove_file(struct device *dev,
701 			const struct device_attribute *attr)
702 {
703 	if (dev)
704 		sysfs_remove_file(&dev->kobj, &attr->attr);
705 }
706 void scsi_remove_host(struct Scsi_Host *shost)
707 {
708 	unsigned long flags;
709 
710 	mutex_lock(&shost->scan_mutex);
711 	spin_lock_irqsave(shost->host_lock, flags);
712 	if (scsi_host_set_state(shost, SHOST_CANCEL))
713 		if (scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY)) {
714 			spin_unlock_irqrestore(shost->host_lock, flags);
715 			mutex_unlock(&shost->scan_mutex);
716 			return;
717 		}
718 	spin_unlock_irqrestore(shost->host_lock, flags);
719 
720 	scsi_autopm_get_host(shost);
721 	flush_workqueue(shost->tmf_work_q);
722 	scsi_forget_host(shost);
723 	mutex_unlock(&shost->scan_mutex);
724 	scsi_proc_host_rm(shost);
725 	scsi_proc_hostdir_rm(shost->hostt);
726 
727 	/*
728 	 * New SCSI devices cannot be attached anymore because of the SCSI host
729 	 * state so drop the tag set refcnt. Wait until the tag set refcnt drops
730 	 * to zero because .exit_cmd_priv implementations may need the host
731 	 * pointer.
732 	 */
733 	kref_put(&shost->tagset_refcnt, scsi_mq_free_tags);
734 	wait_for_completion(&shost->tagset_freed);
735 
736 	spin_lock_irqsave(shost->host_lock, flags);
737 	if (scsi_host_set_state(shost, SHOST_DEL))
738 		BUG_ON(scsi_host_set_state(shost, SHOST_DEL_RECOVERY));
739 	spin_unlock_irqrestore(shost->host_lock, flags);
740 
741 	transport_unregister_device(&shost->shost_gendev);
742 	device_unregister(&shost->shost_dev);
743 	device_del(&shost->shost_gendev);
744 }
745 static void device_links_purge(struct device *dev)
746 {
747 	struct device_link *link, *ln;
748 
749 	if (dev->class == &devlink_class)
750 		return;
751 
752 	/*
753 	 * Delete all of the remaining links from this device to any other
754 	 * devices (either consumers or suppliers).
755 	 */
756 	device_links_write_lock();
757 
758 	list_for_each_entry_safe_reverse(link, ln, &dev->links.suppliers, c_node) {
759 		WARN_ON(link->status == DL_STATE_ACTIVE);
760 		__device_link_del(&link->kref);
761 	}
762 
763 	list_for_each_entry_safe_reverse(link, ln, &dev->links.consumers, s_node) {
764 		WARN_ON(link->status != DL_STATE_DORMANT &&
765 			link->status != DL_STATE_NONE);
766 		__device_link_del(&link->kref);
767 	}
768 
769 	device_links_write_unlock();
770 }
771 static void device_remove_sys_dev_entry(struct device *dev)
772 {
773 	struct kobject *kobj = device_to_dev_kobj(dev);
774 	char devt_str[15];
775 
776 	if (kobj) {
777 		format_dev_t(devt_str, dev->devt);
778 		sysfs_remove_link(kobj, devt_str);
779 	}
780 }
781 static inline int kref_put(struct kref *kref, void (*release)(struct kref *kref))
782 {
783 	if (refcount_dec_and_test(&kref->refcount)) {
784 		release(kref);
785 		return 1;
786 	}
787 	return 0;
788 }
789 static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
790 {
791 	unsigned int ref;
792 
793 	/* see if we live in a "glue" directory */
794 	if (!live_in_glue_dir(glue_dir, dev))
795 		return;
796 
797 	mutex_lock(&gdp_mutex);
798 	/**
799 	 * There is a race condition between removing glue directory
800 	 * and adding a new device under the glue directory.
801 	 *
802 	 * CPU1:                                         CPU2:
803 	 *
804 	 * device_add()
805 	 *   get_device_parent()
806 	 *     class_dir_create_and_add()
807 	 *       kobject_add_internal()
808 	 *         create_dir()    // create glue_dir
809 	 *
810 	 *                                               device_add()
811 	 *                                                 get_device_parent()
812 	 *                                                   kobject_get() // get glue_dir
813 	 *
814 	 * device_del()
815 	 *   cleanup_glue_dir()
816 	 *     kobject_del(glue_dir)
817 	 *
818 	 *                                               kobject_add()
819 	 *                                                 kobject_add_internal()
820 	 *                                                   create_dir() // in glue_dir
821 	 *                                                     sysfs_create_dir_ns()
822 	 *                                                       kernfs_create_dir_ns(sd)
823 	 *
824 	 *       sysfs_remove_dir() // glue_dir->sd=NULL
825 	 *       sysfs_put()        // free glue_dir->sd
826 	 *
827 	 *                                                         // sd is freed
828 	 *                                                         kernfs_new_node(sd)
829 	 *                                                           kernfs_get(glue_dir)
830 	 *                                                           kernfs_add_one()
831 	 *                                                           kernfs_put()
832 	 *
833 	 * Before CPU1 remove last child device under glue dir, if CPU2 add
834 	 * a new device under glue dir, the glue_dir kobject reference count
835 	 * will be increase to 2 in kobject_get(k). And CPU2 has been called
836 	 * kernfs_create_dir_ns(). Meanwhile, CPU1 call sysfs_remove_dir()
837 	 * and sysfs_put(). This result in glue_dir->sd is freed.
838 	 *
839 	 * Then the CPU2 will see a stale "empty" but still potentially used
840 	 * glue dir around in kernfs_new_node().
841 	 *
842 	 * In order to avoid this happening, we also should make sure that
843 	 * kernfs_node for glue_dir is released in CPU1 only when refcount
844 	 * for glue_dir kobj is 1.
845 	 */
846 	ref = kref_read(&glue_dir->kref);
847 	if (!kobject_has_children(glue_dir) && !--ref)
848 		kobject_del(glue_dir);
849 	kobject_put(glue_dir);
850 	mutex_unlock(&gdp_mutex);
851 }
852 void call_rcu(struct rcu_head *head, rcu_callback_t func)
853 {
854 	static atomic_t doublefrees;
855 	unsigned long flags;
856 	struct rcu_data *rdp;
857 	bool was_alldone;
858 
859 	/* Misaligned rcu_head! */
860 	WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
861 
862 	if (debug_rcu_head_queue(head)) {
863 		/*
864 		 * Probable double call_rcu(), so leak the callback.
865 		 * Use rcu:rcu_callback trace event to find the previous
866 		 * time callback was passed to call_rcu().
867 		 */
868 		if (atomic_inc_return(&doublefrees) < 4) {
869 			pr_err("%s(): Double-freed CB %p->%pS()!!!  ", __func__, head, head->func);
870 			mem_dump_obj(head);
871 		}
872 		WRITE_ONCE(head->func, rcu_leak_callback);
873 		return;
874 	}
875 	head->func = func;
876 	head->next = NULL;
877 	kasan_record_aux_stack_noalloc(head);
878 	local_irq_save(flags);
879 	rdp = this_cpu_ptr(&rcu_data);
880 
881 	/* Add the callback to our list. */
882 	if (unlikely(!rcu_segcblist_is_enabled(&rdp->cblist))) {
883 		// This can trigger due to call_rcu() from offline CPU:
884 		WARN_ON_ONCE(rcu_scheduler_active != RCU_SCHEDULER_INACTIVE);
885 		WARN_ON_ONCE(!rcu_is_watching());
886 		// Very early boot, before rcu_init().  Initialize if needed
887 		// and then drop through to queue the callback.
888 		if (rcu_segcblist_empty(&rdp->cblist))
889 			rcu_segcblist_init(&rdp->cblist);
890 	}
891 
892 	check_cb_ovld(rdp);
893 	if (rcu_nocb_try_bypass(rdp, head, &was_alldone, flags))
894 		return; // Enqueued onto ->nocb_bypass, so just leave.
895 	// If no-CBs CPU gets here, rcu_nocb_try_bypass() acquired ->nocb_lock.
896 	rcu_segcblist_enqueue(&rdp->cblist, head);
897 	if (__is_kvfree_rcu_offset((unsigned long)func))
898 		trace_rcu_kvfree_callback(rcu_state.name, head,
899 					 (unsigned long)func,
900 					 rcu_segcblist_n_cbs(&rdp->cblist));
901 	else
902 		trace_rcu_callback(rcu_state.name, head,
903 				   rcu_segcblist_n_cbs(&rdp->cblist));
904 
905 	trace_rcu_segcb_stats(&rdp->cblist, TPS("SegCBQueued"));
906 
907 	/* Go handle any RCU core processing required. */
908 	if (unlikely(rcu_rdp_is_offloaded(rdp))) {
909 		__call_rcu_nocb_wake(rdp, was_alldone, flags); /* unlocks */
910 	} else {
911 		__call_rcu_core(rdp, head, flags);
912 		local_irq_restore(flags);
913 	}
914 }
915 static void show_pwq(struct pool_workqueue *pwq)
916 {
917 	struct worker_pool *pool = pwq->pool;
918 	struct work_struct *work;
919 	struct worker *worker;
920 	bool has_in_flight = false, has_pending = false;
921 	int bkt;
922 
923 	pr_info("  pwq %d:", pool->id);
924 	pr_cont_pool_info(pool);
925 
926 	pr_cont(" active=%d/%d refcnt=%d%s\n",
927 		pwq->nr_active, pwq->max_active, pwq->refcnt,
928 		!list_empty(&pwq->mayday_node) ? " MAYDAY" : "");
929 
930 	hash_for_each(pool->busy_hash, bkt, worker, hentry) {
931 		if (worker->current_pwq == pwq) {
932 			has_in_flight = true;
933 			break;
934 		}
935 	}
936 	if (has_in_flight) {
937 		bool comma = false;
938 
939 		pr_info("    in-flight:");
940 		hash_for_each(pool->busy_hash, bkt, worker, hentry) {
941 			if (worker->current_pwq != pwq)
942 				continue;
943 
944 			pr_cont("%s %d%s:%ps", comma ? "," : "",
945 				task_pid_nr(worker->task),
946 				worker->rescue_wq ? "(RESCUER)" : "",
947 				worker->current_func);
948 			list_for_each_entry(work, &worker->scheduled, entry)
949 				pr_cont_work(false, work);
950 			comma = true;
951 		}
952 		pr_cont("\n");
953 	}
954 
955 	list_for_each_entry(work, &pool->worklist, entry) {
956 		if (get_work_pwq(work) == pwq) {
957 			has_pending = true;
958 			break;
959 		}
960 	}
961 	if (has_pending) {
962 		bool comma = false;
963 
964 		pr_info("    pending:");
965 		list_for_each_entry(work, &pool->worklist, entry) {
966 			if (get_work_pwq(work) != pwq)
967 				continue;
968 
969 			pr_cont_work(comma, work);
970 			comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED);
971 		}
972 		pr_cont("\n");
973 	}
974 
975 	if (!list_empty(&pwq->inactive_works)) {
976 		bool comma = false;
977 
978 		pr_info("    inactive:");
979 		list_for_each_entry(work, &pwq->inactive_works, entry) {
980 			pr_cont_work(comma, work);
981 			comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED);
982 		}
983 		pr_cont("\n");
984 	}
985 }
986 static __always_inline void __rt_mutex_unlock(struct rt_mutex_base *lock)
987 {
988 	if (likely(rt_mutex_cmpxchg_release(lock, current, NULL)))
989 		return;
990 
991 	rt_mutex_slowunlock(lock);
992 }
993 static inline void spin_lock_irq(spinlock_t *lock)
994 {
995 	spin_lock(lock);
996 }
997 static inline int pm_runtime_put_sync(struct device *dev)
998 {
999 	return __pm_runtime_idle(dev, RPM_GET_PUT);
1000 }
1001 static int
1002 lpfc_matchdid(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
1003 	      uint32_t did)
1004 {
1005 	D_ID mydid, ndlpdid, matchdid;
1006 
1007 	if (did == Bcast_DID)
1008 		return 0;
1009 
1010 	/* First check for Direct match */
1011 	if (ndlp->nlp_DID == did)
1012 		return 1;
1013 
1014 	/* Next check for area/domain identically equals 0 match */
1015 	mydid.un.word = vport->fc_myDID;
1016 	if ((mydid.un.b.domain == 0) && (mydid.un.b.area == 0)) {
1017 		return 0;
1018 	}
1019 
1020 	matchdid.un.word = did;
1021 	ndlpdid.un.word = ndlp->nlp_DID;
1022 	if (matchdid.un.b.id == ndlpdid.un.b.id) {
1023 		if ((mydid.un.b.domain == matchdid.un.b.domain) &&
1024 		    (mydid.un.b.area == matchdid.un.b.area)) {
1025 			/* This code is supposed to match the ID
1026 			 * for a private loop device that is
1027 			 * connect to fl_port. But we need to
1028 			 * check that the port did not just go
1029 			 * from pt2pt to fabric or we could end
1030 			 * up matching ndlp->nlp_DID 000001 to
1031 			 * fabric DID 0x20101
1032 			 */
1033 			if ((ndlpdid.un.b.domain == 0) &&
1034 			    (ndlpdid.un.b.area == 0)) {
1035 				if (ndlpdid.un.b.id &&
1036 				    vport->phba->fc_topology ==
1037 				    LPFC_TOPOLOGY_LOOP)
1038 					return 1;
1039 			}
1040 			return 0;
1041 		}
1042 
1043 		matchdid.un.word = ndlp->nlp_DID;
1044 		if ((mydid.un.b.domain == ndlpdid.un.b.domain) &&
1045 		    (mydid.un.b.area == ndlpdid.un.b.area)) {
1046 			if ((matchdid.un.b.domain == 0) &&
1047 			    (matchdid.un.b.area == 0)) {
1048 				if (matchdid.un.b.id)
1049 					return 1;
1050 			}
1051 		}
1052 	}
1053 	return 0;
1054 }
1055 static inline unsigned long _msecs_to_jiffies(const unsigned int m)
1056 {
1057 	return (m + (MSEC_PER_SEC / HZ) - 1) / (MSEC_PER_SEC / HZ);
1058 }
1059 static inline struct device *kobj_to_dev(struct kobject *kobj)
1060 {
1061 	return container_of(kobj, struct device, kobj);
1062 }
1063 signed long __sched schedule_timeout(signed long timeout)
1064 {
1065 	struct process_timer timer;
1066 	unsigned long expire;
1067 
1068 	switch (timeout)
1069 	{
1070 	case MAX_SCHEDULE_TIMEOUT:
1071 		/*
1072 		 * These two special cases are useful to be comfortable
1073 		 * in the caller. Nothing more. We could take
1074 		 * MAX_SCHEDULE_TIMEOUT from one of the negative value
1075 		 * but I' d like to return a valid offset (>=0) to allow
1076 		 * the caller to do everything it want with the retval.
1077 		 */
1078 		schedule();
1079 		goto out;
1080 	default:
1081 		/*
1082 		 * Another bit of PARANOID. Note that the retval will be
1083 		 * 0 since no piece of kernel is supposed to do a check
1084 		 * for a negative retval of schedule_timeout() (since it
1085 		 * should never happens anyway). You just have the printk()
1086 		 * that will tell you if something is gone wrong and where.
1087 		 */
1088 		if (timeout < 0) {
1089 			printk(KERN_ERR "schedule_timeout: wrong timeout "
1090 				"value %lx\n", timeout);
1091 			dump_stack();
1092 			__set_current_state(TASK_RUNNING);
1093 			goto out;
1094 		}
1095 	}
1096 
1097 	expire = timeout + jiffies;
1098 
1099 	timer.task = current;
1100 	timer_setup_on_stack(&timer.timer, process_timeout, 0);
1101 	__mod_timer(&timer.timer, expire, MOD_TIMER_NOTPENDING);
1102 	schedule();
1103 	del_singleshot_timer_sync(&timer.timer);
1104 
1105 	/* Remove the timer from the object tracker */
1106 	destroy_timer_on_stack(&timer.timer);
1107 
1108 	timeout = expire - jiffies;
1109 
1110  out:
1111 	return timeout < 0 ? 0 : timeout;
1112 }
1113 int kobject_uevent(struct kobject *kobj, enum kobject_action action)
1114 {
1115 	return kobject_uevent_env(kobj, action, NULL);
1116 }
1117 static inline void kfree(void *p)
1118 {
1119 	if (p >= __kfree_ignore_start && p < __kfree_ignore_end)
1120 		return;
1121 	free(p);
1122 }
1123 void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
1124 {
1125 	struct proc_dir_entry *de = NULL;
1126 	const char *fn = name;
1127 	unsigned int len;
1128 
1129 	write_lock(&proc_subdir_lock);
1130 	if (__xlate_proc_name(name, &parent, &fn) != 0) {
1131 		write_unlock(&proc_subdir_lock);
1132 		return;
1133 	}
1134 	len = strlen(fn);
1135 
1136 	de = pde_subdir_find(parent, fn, len);
1137 	if (de) {
1138 		if (unlikely(pde_is_permanent(de))) {
1139 			WARN(1, "removing permanent /proc entry '%s'", de->name);
1140 			de = NULL;
1141 		} else {
1142 			rb_erase(&de->subdir_node, &parent->subdir);
1143 			if (S_ISDIR(de->mode))
1144 				parent->nlink--;
1145 		}
1146 	}
1147 	write_unlock(&proc_subdir_lock);
1148 	if (!de) {
1149 		WARN(1, "name '%s'\n", name);
1150 		return;
1151 	}
1152 
1153 	proc_entry_rundown(de);
1154 
1155 	WARN(pde_subdir_first(de),
1156 	     "%s: removing non-empty directory '%s/%s', leaking at least '%s'\n",
1157 	     __func__, de->parent->name, de->name, pde_subdir_first(de)->name);
1158 	pde_put(de);
1159 }
1160 static inline void list_del(struct list_head *entry)
1161 {
1162 	__list_del_entry(entry);
1163 	entry->next = LIST_POISON1;
1164 	entry->prev = LIST_POISON2;
1165 }
1166 static void put_pwq_unlocked(struct pool_workqueue *pwq)
1167 {
1168 	if (pwq) {
1169 		/*
1170 		 * As both pwqs and pools are RCU protected, the
1171 		 * following lock operations are safe.
1172 		 */
1173 		raw_spin_lock_irq(&pwq->pool->lock);
1174 		put_pwq(pwq);
1175 		raw_spin_unlock_irq(&pwq->pool->lock);
1176 	}
1177 }
1178 static int
1179 fc_queue_work(struct Scsi_Host *shost, struct work_struct *work)
1180 {
1181 	if (unlikely(!fc_host_work_q(shost))) {
1182 		printk(KERN_ERR
1183 			"ERROR: FC host '%s' attempted to queue work, "
1184 			"when no workqueue created.\n", shost->hostt->name);
1185 		dump_stack();
1186 
1187 		return -EINVAL;
1188 	}
1189 
1190 	return queue_work(fc_host_work_q(shost), work);
1191 }
1192 static inline void
1193 transport_unregister_device(struct device *dev)
1194 {
1195 	transport_remove_device(dev);
1196 	transport_destroy_device(dev);
1197 }
1198 void driver_deferred_probe_del(struct device *dev)
1199 {
1200 	mutex_lock(&deferred_probe_mutex);
1201 	if (!list_empty(&dev->p->deferred_probe)) {
1202 		dev_dbg(dev, "Removed from deferred list\n");
1203 		list_del_init(&dev->p->deferred_probe);
1204 		__device_set_deferred_probe_reason(dev, NULL);
1205 	}
1206 	mutex_unlock(&deferred_probe_mutex);
1207 }
1208 static inline const char *dev_name(const struct device *dev)
1209 {
1210 	/* Use the init name until the kobject becomes available */
1211 	if (dev->init_name)
1212 		return dev->init_name;
1213 
1214 	return kobject_name(&dev->kobj);
1215 }
1216 void scsi_flush_work(struct Scsi_Host *shost)
1217 {
1218 	if (!shost->work_q) {
1219 		shost_printk(KERN_ERR, shost,
1220 			"ERROR: Scsi host '%s' attempted to flush scsi-work, "
1221 			"when no workqueue created.\n", shost->hostt->name);
1222 		dump_stack();
1223 		return;
1224 	}
1225 
1226 	flush_workqueue(shost->work_q);
1227 }
1228 static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long f)
1229 {
1230 	spin_unlock(lock);
1231 }
1232 static inline void spin_lock(spinlock_t *lock)
1233 {
1234 	int ret = pthread_spin_lock(lock);
1235 	assert(!ret);
1236 }
1237 static inline int pm_runtime_get_sync(struct device *dev)
1238 {
1239 	return __pm_runtime_resume(dev, RPM_GET_PUT);
1240 }
1241 static struct lpfc_nodelist *
1242 __lpfc_findnode_did(struct lpfc_vport *vport, uint32_t did)
1243 {
1244 	struct lpfc_nodelist *ndlp;
1245 	uint32_t data1;
1246 
1247 	list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
1248 		if (lpfc_matchdid(vport, ndlp, did)) {
1249 			data1 = (((uint32_t)ndlp->nlp_state << 24) |
1250 				 ((uint32_t)ndlp->nlp_xri << 16) |
1251 				 ((uint32_t)ndlp->nlp_type << 8)
1252 				 );
1253 			lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE,
1254 					 "0929 FIND node DID "
1255 					 "Data: x%px x%x x%x x%x x%x x%px\n",
1256 					 ndlp, ndlp->nlp_DID,
1257 					 ndlp->nlp_flag, data1, ndlp->nlp_rpi,
1258 					 ndlp->active_rrqs_xri_bitmap);
1259 			return ndlp;
1260 		}
1261 	}
1262 
1263 	/* FIND node did <did> NOT FOUND */
1264 	lpfc_printf_vlog(vport, KERN_INFO, LOG_NODE,
1265 			 "0932 FIND node did x%x NOT FOUND.\n", did);
1266 	return NULL;
1267 }
1268 void scsi_forget_host(struct Scsi_Host *shost)
1269 {
1270 	struct scsi_device *sdev;
1271 	unsigned long flags;
1272 
1273  restart:
1274 	spin_lock_irqsave(shost->host_lock, flags);
1275 	list_for_each_entry(sdev, &shost->__devices, siblings) {
1276 		if (sdev->sdev_state == SDEV_DEL)
1277 			continue;
1278 		spin_unlock_irqrestore(shost->host_lock, flags);
1279 		__scsi_remove_device(sdev);
1280 		goto restart;
1281 	}
1282 	spin_unlock_irqrestore(shost->host_lock, flags);
1283 }
1284 void sysfs_remove_bin_file(struct kobject *kobj,
1285 			   const struct bin_attribute *attr)
1286 {
1287 	kernfs_remove_by_name(kobj->sd, attr->attr.name);
1288 }
1289 int blocking_notifier_call_chain(struct blocking_notifier_head *nh,
1290 		unsigned long val, void *v)
1291 {
1292 	int ret = NOTIFY_DONE;
1293 
1294 	/*
1295 	 * We check the head outside the lock, but if this access is
1296 	 * racy then it does not matter what the result of the test
1297 	 * is, we re-check the list after having taken the lock anyway:
1298 	 */
1299 	if (rcu_access_pointer(nh->head)) {
1300 		down_read(&nh->rwsem);
1301 		ret = notifier_call_chain(&nh->head, val, v, -1, NULL);
1302 		up_read(&nh->rwsem);
1303 	}
1304 	return ret;
1305 }
1306 static noinline void __sched
1307 __mutex_lock_slowpath(struct mutex *lock)
1308 {
1309 	__mutex_lock(lock, TASK_UNINTERRUPTIBLE, 0, NULL, _RET_IP_);
1310 }
1311 static inline void device_unlock(struct device *dev)
1312 {
1313 	mutex_unlock(&dev->mutex);
1314 }
1315 void klist_del(struct klist_node *n)
1316 {
1317 	klist_put(n, true);
1318 }
1319 static inline void spin_lock_irqsave(spinlock_t *lock, unsigned long f)
1320 {
1321 	spin_lock(lock);
1322 }
1323 /* P3 */ printk(KERN_ERR
1324   "bitmap out: size %d used %d off %d len %d align %d count %d\n",
1325   t->size, t->used, offset, len, align, count);
1326 			return -1;
1327 		}
1328 
1329 		if (offset + len > t->size) {
1330 			count += t->size - offset;
1331 			offset = 0;
1332 			continue;
1333 		}
1334 
1335 		i = 0;
1336 		while (test_bit(offset + i, t->map) == 0) {
1337 			i++;
1338 			if (i == len) {
1339 				bitmap_set(t->map, offset, len);
1340 				if (offset == t->first_free)
1341 					t->first_free = find_next_zero_bit
1342 							(t->map, t->size,
1343 							 t->first_free + len);
1344 				if ((t->last_off = offset + len) >= t->size)
1345 					t->last_off = 0;
1346 				t->used += len;
1347 				t->last_size = len;
1348 				spin_unlock(&t->lock);
1349 				return offset;
1350 			}
1351 		}
1352 		count += i + 1;
1353 		if ((offset += i + 1) >= t->size)
1354 			offset = 0;
1355 	}
1356 }
1357 static inline void list_del_rcu(struct list_head *entry)
1358 {
1359 	__list_del_entry(entry);
1360 	entry->prev = LIST_POISON2;
1361 }
1362 static void device_platform_notify_remove(struct device *dev)
1363 {
1364 	acpi_device_notify_remove(dev);
1365 
1366 	software_node_notify_remove(dev);
1367 
1368 	if (platform_notify_remove)
1369 		platform_notify_remove(dev);
1370 }
1371 int kthread_stop(struct task_struct *k)
1372 {
1373 	struct kthread *kthread;
1374 	int ret;
1375 
1376 	trace_sched_kthread_stop(k);
1377 
1378 	get_task_struct(k);
1379 	kthread = to_kthread(k);
1380 	set_bit(KTHREAD_SHOULD_STOP, &kthread->flags);
1381 	kthread_unpark(k);
1382 	set_tsk_thread_flag(k, TIF_NOTIFY_SIGNAL);
1383 	wake_up_process(k);
1384 	wait_for_completion(&kthread->exited);
1385 	ret = kthread->result;
1386 	put_task_struct(k);
1387 
1388 	trace_sched_kthread_stop_ret(ret);
1389 	return ret;
1390 }
1391 static inline bool queue_work(struct workqueue_struct *wq,
1392 			      struct work_struct *work)
1393 {
1394 	BUG();
1395 	return true;
1396 }
1397 void device_pm_remove(struct device *dev)
1398 {
1399 	if (device_pm_not_required(dev))
1400 		return;
1401 
1402 	pr_debug("Removing info for %s:%s\n",
1403 		 dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
1404 	complete_all(&dev->power.completion);
1405 	mutex_lock(&dpm_list_mtx);
1406 	list_del_init(&dev->power.entry);
1407 	dev->power.in_dpm_list = false;
1408 	mutex_unlock(&dpm_list_mtx);
1409 	device_wakeup_disable(dev);
1410 	pm_runtime_remove(dev);
1411 	device_pm_check_callbacks(dev);
1412 }
1413 static __always_inline unsigned long msecs_to_jiffies(const unsigned int m)
1414 {
1415 	if (__builtin_constant_p(m)) {
1416 		if ((int)m < 0)
1417 			return MAX_JIFFY_OFFSET;
1418 		return _msecs_to_jiffies(m);
1419 	} else {
1420 		return __msecs_to_jiffies(m);
1421 	}
1422 }
1423 void dump_stack(void)
1424 {
1425 	void *array[16];
1426 	size_t size = backtrace(array, ARRAY_SIZE(array));
1427 	char **strings = backtrace_symbols(array, size);
1428 	size_t i;
1429 
1430 	printf("Obtained %zd stack frames.\n", size);
1431 
1432 	for (i = 0; i < size; i++)
1433 		printf("%s\n", strings[i]);
1434 
1435 	free(strings);
1436 }
1437 struct Scsi_Host *scsi_host_get(struct Scsi_Host *shost)
1438 {
1439 	if ((shost->shost_state == SHOST_DEL) ||
1440 		!get_device(&shost->shost_gendev))
1441 		return NULL;
1442 	return shost;
1443 }
1444 static __always_inline bool __mutex_trylock_fast(struct mutex *lock)
1445 {
1446 	unsigned long curr = (unsigned long)current;
1447 	unsigned long zero = 0UL;
1448 
1449 	if (atomic_long_try_cmpxchg_acquire(&lock->owner, &zero, curr))
1450 		return true;
1451 
1452 	return false;
1453 }
1454 void device_del(struct device *dev)
1455 {
1456 	struct device *parent = dev->parent;
1457 	struct kobject *glue_dir = NULL;
1458 	struct class_interface *class_intf;
1459 	unsigned int noio_flag;
1460 
1461 	device_lock(dev);
1462 	kill_device(dev);
1463 	device_unlock(dev);
1464 
1465 	if (dev->fwnode && dev->fwnode->dev == dev)
1466 		dev->fwnode->dev = NULL;
1467 
1468 	/* Notify clients of device removal.  This call must come
1469 	 * before dpm_sysfs_remove().
1470 	 */
1471 	noio_flag = memalloc_noio_save();
1472 	if (dev->bus)
1473 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
1474 					     BUS_NOTIFY_DEL_DEVICE, dev);
1475 
1476 	dpm_sysfs_remove(dev);
1477 	if (parent)
1478 		klist_del(&dev->p->knode_parent);
1479 	if (MAJOR(dev->devt)) {
1480 		devtmpfs_delete_node(dev);
1481 		device_remove_sys_dev_entry(dev);
1482 		device_remove_file(dev, &dev_attr_dev);
1483 	}
1484 	if (dev->class) {
1485 		device_remove_class_symlinks(dev);
1486 
1487 		mutex_lock(&dev->class->p->mutex);
1488 		/* notify any interfaces that the device is now gone */
1489 		list_for_each_entry(class_intf,
1490 				    &dev->class->p->interfaces, node)
1491 			if (class_intf->remove_dev)
1492 				class_intf->remove_dev(dev, class_intf);
1493 		/* remove the device from the class list */
1494 		klist_del(&dev->p->knode_class);
1495 		mutex_unlock(&dev->class->p->mutex);
1496 	}
1497 	device_remove_file(dev, &dev_attr_uevent);
1498 	device_remove_attrs(dev);
1499 	bus_remove_device(dev);
1500 	device_pm_remove(dev);
1501 	driver_deferred_probe_del(dev);
1502 	device_platform_notify_remove(dev);
1503 	device_links_purge(dev);
1504 
1505 	/*
1506 	 * If a device does not have a driver attached, we need to clean
1507 	 * up any managed resources. We do this in device_release(), but
1508 	 * it's never called (and we leak the device) if a managed
1509 	 * resource holds a reference to the device. So release all
1510 	 * managed resources here, like we do in driver_detach(). We
1511 	 * still need to do so again in device_release() in case someone
1512 	 * adds a new resource after this point, though.
1513 	 */
1514 	devres_release_all(dev);
1515 
1516 	if (dev->bus)
1517 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
1518 					     BUS_NOTIFY_REMOVED_DEVICE, dev);
1519 	kobject_uevent(&dev->kobj, KOBJ_REMOVE);
1520 	glue_dir = get_glue_dir(dev);
1521 	kobject_del(&dev->kobj);
1522 	cleanup_glue_dir(dev, glue_dir);
1523 	memalloc_noio_restore(noio_flag);
1524 	put_device(parent);
1525 }
1526 static void wq_unregister_lockdep(struct workqueue_struct *wq)
1527 {
1528 	lockdep_unregister_key(&wq->key);
1529 }
1530 void transport_destroy_device(struct device *dev)
1531 {
1532 	attribute_container_remove_device(dev, transport_destroy_classdev);
1533 }
1534 unsigned long __msecs_to_jiffies(const unsigned int m)
1535 {
1536 	/*
1537 	 * Negative value, means infinite timeout:
1538 	 */
1539 	if ((int)m < 0)
1540 		return MAX_JIFFY_OFFSET;
1541 	return _msecs_to_jiffies(m);
1542 }
1543 struct kobject *kobject_get(struct kobject *kobj)
1544 {
1545 	if (kobj) {
1546 		if (!kobj->state_initialized)
1547 			WARN(1, KERN_WARNING
1548 				"kobject: '%s' (%p): is not initialized, yet kobject_get() is being called.\n",
1549 			     kobject_name(kobj), kobj);
1550 		kref_get(&kobj->kref);
1551 	}
1552 	return kobj;
1553 }
1554 static int release(struct uio_info *info, struct inode *inode)
1555 {
1556 	struct uio_pci_generic_dev *gdev = to_uio_pci_generic_dev(info);
1557 
1558 	/*
1559 	 * This driver is insecure when used with devices doing DMA, but some
1560 	 * people (mis)use it with such devices.
1561 	 * Let's at least make sure DMA isn't left enabled after the userspace
1562 	 * driver closes the fd.
1563 	 * Note that there's a non-zero chance doing this will wedge the device
1564 	 * at least until reset.
1565 	 */
1566 	pci_clear_master(gdev->pdev);
1567 	return 0;
1568 }
1569 static inline void spin_unlock_irq(spinlock_t *lock)
1570 {
1571 	spin_unlock(lock);
1572 }
1573 signed long __sched schedule_timeout_uninterruptible(signed long timeout)
1574 {
1575 	__set_current_state(TASK_UNINTERRUPTIBLE);
1576 	return schedule_timeout(timeout);
1577 }
1578 void bus_remove_device(struct device *dev)
1579 {
1580 	struct bus_type *bus = dev->bus;
1581 	struct subsys_interface *sif;
1582 
1583 	if (!bus)
1584 		return;
1585 
1586 	mutex_lock(&bus->p->mutex);
1587 	list_for_each_entry(sif, &bus->p->interfaces, node)
1588 		if (sif->remove_dev)
1589 			sif->remove_dev(dev, sif);
1590 	mutex_unlock(&bus->p->mutex);
1591 
1592 	sysfs_remove_link(&dev->kobj, "subsystem");
1593 	sysfs_remove_link(&dev->bus->p->devices_kset->kobj,
1594 			  dev_name(dev));
1595 	device_remove_groups(dev, dev->bus->dev_groups);
1596 	if (klist_node_attached(&dev->p->knode_bus))
1597 		klist_del(&dev->p->knode_bus);
1598 
1599 	pr_debug("bus: '%s': remove device %s\n",
1600 		 dev->bus->name, dev_name(dev));
1601 	device_release_driver(dev);
1602 	bus_put(dev->bus);
1603 }
1604 static void workqueue_sysfs_unregister(struct workqueue_struct *wq)
1605 {
1606 	struct wq_device *wq_dev = wq->wq_dev;
1607 
1608 	if (!wq->wq_dev)
1609 		return;
1610 
1611 	wq->wq_dev = NULL;
1612 	device_unregister(&wq_dev->dev);
1613 }
1614 void destroy_workqueue(struct workqueue_struct *wq)
1615 {
1616 	struct pool_workqueue *pwq;
1617 	int node;
1618 
1619 	/*
1620 	 * Remove it from sysfs first so that sanity check failure doesn't
1621 	 * lead to sysfs name conflicts.
1622 	 */
1623 	workqueue_sysfs_unregister(wq);
1624 
1625 	/* drain it before proceeding with destruction */
1626 	drain_workqueue(wq);
1627 
1628 	/* kill rescuer, if sanity checks fail, leave it w/o rescuer */
1629 	if (wq->rescuer) {
1630 		struct worker *rescuer = wq->rescuer;
1631 
1632 		/* this prevents new queueing */
1633 		raw_spin_lock_irq(&wq_mayday_lock);
1634 		wq->rescuer = NULL;
1635 		raw_spin_unlock_irq(&wq_mayday_lock);
1636 
1637 		/* rescuer will empty maydays list before exiting */
1638 		kthread_stop(rescuer->task);
1639 		kfree(rescuer);
1640 	}
1641 
1642 	/*
1643 	 * Sanity checks - grab all the locks so that we wait for all
1644 	 * in-flight operations which may do put_pwq().
1645 	 */
1646 	mutex_lock(&wq_pool_mutex);
1647 	mutex_lock(&wq->mutex);
1648 	for_each_pwq(pwq, wq) {
1649 		raw_spin_lock_irq(&pwq->pool->lock);
1650 		if (WARN_ON(pwq_busy(pwq))) {
1651 			pr_warn("%s: %s has the following busy pwq\n",
1652 				__func__, wq->name);
1653 			show_pwq(pwq);
1654 			raw_spin_unlock_irq(&pwq->pool->lock);
1655 			mutex_unlock(&wq->mutex);
1656 			mutex_unlock(&wq_pool_mutex);
1657 			show_one_workqueue(wq);
1658 			return;
1659 		}
1660 		raw_spin_unlock_irq(&pwq->pool->lock);
1661 	}
1662 	mutex_unlock(&wq->mutex);
1663 
1664 	/*
1665 	 * wq list is used to freeze wq, remove from list after
1666 	 * flushing is complete in case freeze races us.
1667 	 */
1668 	list_del_rcu(&wq->list);
1669 	mutex_unlock(&wq_pool_mutex);
1670 
1671 	if (!(wq->flags & WQ_UNBOUND)) {
1672 		wq_unregister_lockdep(wq);
1673 		/*
1674 		 * The base ref is never dropped on per-cpu pwqs.  Directly
1675 		 * schedule RCU free.
1676 		 */
1677 		call_rcu(&wq->rcu, rcu_free_wq);
1678 	} else {
1679 		/*
1680 		 * We're the sole accessor of @wq at this point.  Directly
1681 		 * access numa_pwq_tbl[] and dfl_pwq to put the base refs.
1682 		 * @wq will be freed when the last pwq is released.
1683 		 */
1684 		for_each_node(node) {
1685 			pwq = rcu_access_pointer(wq->numa_pwq_tbl[node]);
1686 			RCU_INIT_POINTER(wq->numa_pwq_tbl[node], NULL);
1687 			put_pwq_unlocked(pwq);
1688 		}
1689 
1690 		/*
1691 		 * Put dfl_pwq.  @wq may be freed any time after dfl_pwq is
1692 		 * put.  Don't access it afterwards.
1693 		 */
1694 		pwq = wq->dfl_pwq;
1695 		wq->dfl_pwq = NULL;
1696 		put_pwq_unlocked(pwq);
1697 	}
1698 }
1699 void put_device(struct device *dev)
1700 {
1701 	/* might_sleep(); */
1702 	if (dev)
1703 		kobject_put(&dev->kobj);
1704 }
```
which has a CWE-457 vulnerability at line:
```
10 	spin_unlock_irqrestore(shost->host_lock, iflags);
```
Please generate five possible patches for the vulnerability.