Re: [linux-usb-devel] BUG when removing USB flash drive

[James Bottomley <James.Bottomley@steeleye.com>]

On Fri, 2004-05-14 at 14:33, Alan Stern wrote:
> usb-storage checks the state of its kernel thread after calling
> scsi_remove_host(), while preparing to kill the thread.  This can only
> be done while the thread is idle, not processing any queued commands or
> error handler requests.  The BUG in Alberto's log was triggered because
> the thread was not idle.  Unfortunately the log doesn't say whether it was
> executing a queued command or an error handler request at the time.

The idea behind scsi_remove_host() was that it was going to be called
from the module_exit() routine.  This means that the reference count on
the LLD has already dropped to zero and it's safe for removal.

If you call scsi_remove_host() outside of the module_exit() code then
what it does is remove all hosts from visibility (and makes it
impossible to open or do anything with them), but it cannot revoke
outstanding references (which may continue to use the device).  The
mid-layer takes the devices through CANCEL and then DEL.  When
scsi_remove_host() returns, you are guaranteed (barring any state model
cockups) that the devices on the LLD with outstanding references are all
in the DEL state.  It will also block the device from above (no commands
will be sent down).  Any currently outstanding commands will be errored
from the mid-layer; however, it will do nothing about outstanding
commands in the LLD, you have to deal with them yourself.

The way this is supposed to work is that when you get a disconnection,
you start refusing commands (and you also discard any active ones). 
Then you call scsi_remove_host().  We discard all current commands

So, if the usb storage LLD isn't discarding the commands, then they may
be active.

James