Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6:
  [SCSI] fix race in scsi_target_reap
  [SCSI] aacraid: Eliminate use after free
  [SCSI] arcmsr: Support HW reset for EH and polling scheme for scsi device
  [SCSI] bfa: fix system crash when reading sysfs fc_host statistics
  [SCSI] iscsi_tcp: remove sk_sleep check
  [SCSI] ipr: improve interrupt service routine performance
  [SCSI] ipr: set the data list length in the request control block
  [SCSI] ipr: fix a register read to use the correct address for 64 bit adapters
  [SCSI] ipr: include the resource path in the IOA status area structure
  [SCSI] ipr: implement fixes for 64 bit adapter support
  [SCSI] be2iscsi: correct return value in mgmt_invalidate_icds()

diff --combined drivers/scsi/scsi_scan.c
index 9798c2c06b93d65257931a8796148e68a48eb730,a77468cd5a33889f41ec02340ab90a294cf513f4..1c027a97d8b9ea570d0a48d254908a71cfe84377
--- 1/drivers/scsi/scsi_scan.c
--- 2/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@@ -492,19 -492,20 +492,20 @@@ void scsi_target_reap(struct scsi_targe
        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
        unsigned long flags;
        enum scsi_target_state state;
-       int empty;
+       int empty = 0;
  
        spin_lock_irqsave(shost->host_lock, flags);
        state = starget->state;
-       empty = --starget->reap_ref == 0 &&
-               list_empty(&starget->devices) ? 1 : 0;
+       if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
+               empty = 1;
+               starget->state = STARGET_DEL;
+       }
        spin_unlock_irqrestore(shost->host_lock, flags);
  
        if (!empty)
                return;
  
        BUG_ON(state == STARGET_DEL);
-       starget->state = STARGET_DEL;
        if (state == STARGET_CREATED)
                scsi_target_destroy(starget);
        else
@@@ -1220,7 -1221,7 +1221,7 @@@ static void scsi_sequential_lun_scan(st
  }
  
  /**
 - * scsilun_to_int: convert a scsi_lun to an int
 + * scsilun_to_int - convert a scsi_lun to an int
   * @scsilun:  struct scsi_lun to be converted.
   *
   * Description:
@@@ -1252,7 -1253,7 +1253,7 @@@ int scsilun_to_int(struct scsi_lun *scs
  EXPORT_SYMBOL(scsilun_to_int);
  
  /**
 - * int_to_scsilun: reverts an int into a scsi_lun
 + * int_to_scsilun - reverts an int into a scsi_lun
   * @lun:        integer to be reverted
   * @scsilun:  struct scsi_lun to be set.
   *
@@@ -1876,9 -1877,12 +1877,9 @@@ void scsi_forget_host(struct Scsi_Host 
        spin_unlock_irqrestore(shost->host_lock, flags);
  }
  
 -/*
 - * Function:    scsi_get_host_dev()
 - *
 - * Purpose:     Create a scsi_device that points to the host adapter itself.
 - *
 - * Arguments:   SHpnt   - Host that needs a scsi_device
 +/**
 + * scsi_get_host_dev - Create a scsi_device that points to the host adapter itself
 + * @shost: Host that needs a scsi_device
   *
   * Lock status: None assumed.
   *
@@@ -1891,7 -1895,7 +1892,7 @@@
   *
   *    Note - this device is not accessible from any high-level
   *    drivers (including generics), which is probably not
 - *    optimal.  We can add hooks later to attach 
 + *    optimal.  We can add hooks later to attach.
   */
  struct scsi_device *scsi_get_host_dev(struct Scsi_Host *shost)
  {
@@@ -1917,13 -1921,18 +1918,13 @@@
  }
  EXPORT_SYMBOL(scsi_get_host_dev);
  
 -/*
 - * Function:    scsi_free_host_dev()
 - *
 - * Purpose:     Free a scsi_device that points to the host adapter itself.
 - *
 - * Arguments:   SHpnt   - Host that needs a scsi_device
 +/**
 + * scsi_free_host_dev - Free a scsi_device that points to the host adapter itself
 + * @sdev: Host device to be freed
   *
   * Lock status: None assumed.
   *
   * Returns:     Nothing
 - *
 - * Notes:
   */
  void scsi_free_host_dev(struct scsi_device *sdev)
  {