Re: [linux-usb-devel] BUG when removing USB flash drive

[Mike Anderson <andmike@us.ibm.com>]

Alan Stern [stern@rowland.harvard.edu] wrote:
> This BUG happened because the SCSI layer was still using the drive after 
> usb-storage had called scsi_remove_host().

In this case the scsi_remove_host is being called in a unexpected
disconnect case. Any IOs in flight will be canceled in the mid-layer
(i.e., they will not be chased down with calls to eh_abort_handler).

> 
> This is an aspect of SCSI midlayer <-> low-level driver interaction that
> I'm not very clear about.  How long after the host is removed can the
> midlayer continue to use it?  How does the driver know when the midlayer
> is finished using the host so the driver can exit (and unload from
> memory)?

The LLDD queuecommand should not be called after the return of
scsi_remove_host (unless we have a bug). The LLDD should not free its
resources until the release function is called on the struct device
passed in during the scsi_add_host call. This release function could be
called post the scsi_host_dev_release function being called as it does a
put on this struct device. This chain of release calls is undefined as a
hotplug goes out on the remove calls, but if user space never umounts /
closes the device things will not fully cleanup.

-andmike
--
Michael Anderson
andmike@us.ibm.com