RE: [PATCH] mtd: use refcount to prevent corruption

Winkler, Tomas
2021-01-29T16:13:17Z

>
> Tomas,
>
> ----- Ursprüngliche Mail -----
> >> As Richard was saying, we are really open to enhance MTD refcounting.
> >>
> >> However, the issue you are facing is, IMHO, not related to MTD but to MFD.
> >> There should be a way to avoid MFD to vanish by taking a reference of
> >> it through mtd->_get_device(). I don't think addressing the case
> >> where MFD vanishes while MTD (as a user) is still active is the right
> approach.
> >
> > I think it won't work because MFD sub-driver remove() is called and it must
> > succeed because the main device is not accessible unlike glueubi
> > which just returns -EBUSY.
>
> Well, the trick in glubi (and other MTDs with "hotplug" support) is not to reject
> removal of the sub-device. ->_put_device() is of return type void.
> The key is grabbing a reference on the sub-device in ->_get_device() such that
> the layer below doesn't even try to remove while the MTD is in use.
>
> > so we postpone the mtd unregister to mtd_info->_put_device() but it
> > that state we have nothing to hold on as the device is gone in
> > remove() User will fail anyway, as the underlying device is not
> > functional in that state.
> > Anyway I've tried your suggestion, the kernel is crashing, hope I
> > haven't done some silly bug.
>
> Can you point us to the affected code?
> This would help a lot to understand the issue better.
Below is approximately the snippet

> I'm sure we can find a solution.
Okay though I've already found a working solution.

struct my_spi {
struct mtd_info mtd;
struct kref refcnt;
bool init;
};

static int my_spi_get_mtd(struct mtd_info *mtd)
{
struct my_spi *spi = container_of(mtd, struct my_spi, mtd);

if (!spi->init)
return -ENODEV;

kref_get(&spi->refcnt);

spi->init = true;

return 0;
}

static void my_spi_unregister_mtd(struct kref *kref)
{
struct my_spi *spi = container_of(kref, struct my_spi, refcnt);

mtd_device_unregister(&spi->mtd);
kfree(spi);
}

static int my_spi_put_mtd(struct mtd_info *mtd)
{
struct my_spi *spi = container_of(mtd, struct my_spi, mtd);

kref_put(&spi->refcnt, my_spi_unregister_mtd);

return 0;
}

static int my_spi_init_mtd(static my_spi *spi)
{
...
spi->mtd._get_device = my_spi_get_mtd;
spi->mtd._get_device = my_spi_put_mtd;
kref_init(&spi->refcnt);
...
}

static int my_spi_probe(struct platform_device *platdev)
{
...
spi = kzalloc(size, GFP_KERNEL);
spi->init = true;
my_spi_init_mtd(spi);
platform_set_drvdata(platdev, spi);
...
return 0;
}

static int my_spi_remove(struct platform_device *platdev)
{
struct my_spi *spi = platform_get_drvdata(platdev);
spi->init = false;
my_spi_put_mtd(&spi->mtd);
platform_set_drvdata(platdev, NULL);
}