Re: [Patch] Fix oops on rmmod usb-storage

[Hannes Reinecke <hare@suse.de>]

Alan Stern wrote:
> On Thu, 30 Sep 2004, Hannes Reinecke wrote:
> 
> 
>>Ok, since this is essential the same thread then on linux-scsi
>>(cf. "Bug: CD driver sends commands during host removal") the same 
>>solution applies here also.
>>
>>Alan, I did a different patch which omit the special case handling in
>>scsiglue.c and rather reorders usb_stor_control_thread. I'd prefer mine 
>>(naturally), but any of those will do.
>>And yes, both patches fix the problem.
>>
>>Back to the maintainer for patch inclusion.
>>
>>Cheers,
>>
>>Hannes
> 
> 
> No, your patch is incorrect.  In fact, it resembles the way the driver 
> used to work -- which caused an occasional oops.  The problem is that by 
> the time the usb_stor_control_thread() wakes up and sees that it has a new 
> command to process, the SCSI core may already have deallocated the 
> scsi_cmnd structure.  So the line where you assign to us->srb->result is 
> liable to raise an addressing exception.
> 
> Alan Stern
> 
Ok. (I knew there was something subtle going on).
What about the check for disconnecting later in 
usb.c:usb_stor_control_thread?
It will only trigger if usb_stor_control_thread has been awakened by 
some other command and the device has been disconnected between 
awakening and executing this check.
(This may well be impossible to trigger, but the set_bit() in 
storage_disconnect() appears not to be protected by any lock).
And I doubt it will work properly in that case as no scsi_done is not 
called nor a proper status is set.
Is this check still needed or can it be removed?

Cheers,

Hannes
-- 
Dr. Hannes Reinecke			hare@suse.de
SuSE Linux AG				S390 & zSeries
Maxfeldstraße 5				+49 911 74053 688
90409 Nürnberg				http://www.suse.de
-
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html