Re: [PATCH] kobject: provide kobject_put_wait to fix module unload race

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Sat, Jan 04, 2014 at 03:35:39PM -0500, Mikulas Patocka wrote:
> 
> 
> On Sat, 4 Jan 2014, Greg Kroah-Hartman wrote:
> 
> > On Sat, Jan 04, 2014 at 01:06:01PM -0500, Mikulas Patocka wrote:
> > > Hi
> > > 
> > > I noticed that Jeff Mahoney added a new structure kobj_completion, defined 
> > > in include/linux/kobj_completion.h to the kernel 3.13-rc1 in the patch 
> > > eee031649707db3c9920d9498f8d03819b74fc23. In the current upstream kernel, 
> > > this interface is still unused.
> > 
> > There are pending btrfs patches to use this interface.
> > 
> > > However, converting the drivers to use kobj_completion is not trivial 
> > > (note that all users of the original kobject interface are buggy - so all 
> > > of them need to be converted).
> > 
> > Wait, what?  How are "all users" buggy?  Please explain this in detail.
> 
> 1) some code takes a reference to a kobject
> 2) the user unloads the device
> 3) the device driver unload routine calls kobject_put (but there is still 
>    reference, so the kobject is not destroyed)

A driver should never be messing around with "raw" kobjects, they should
be using a 'struct device' which is created/managed by the subsystem
they belong to.  See Dmitry's example of input and serio as ways to do
this, also USB and PCI do this properly.

Perhaps your sybsystem isn't doing this properly?  What code do you have
that creates raw kobjects and has this problem?

thanks,

greg k-h