Re: [linux-usb-devel] BUG when removing USB flash drive

Alan Stern
2004-05-14T19:33:16Z

On Fri, 14 May 2004, Mike Anderson wrote:

> I was incorrect in my previous statement. Well we may hold a reference
> count on the struct device passed into the scsi_add_host until all
> references on the host instance are gone and there maybe a positive ref
> count on the hostt module until all devices are closed a instance of
> LLDD should be able to do cleanup post return of scsi_remove_host. This
> needs to be true or SCSI mid-layer would not honor the requirement for
> the pci remove call.
>
> I believe in the past you or someone else has mentioned that post the
> return of scsi_remove_host a Scsi_Host instance still has a hostt and a
> transportt which may be dangerous if all code paths are not correctly
> handling a host in the SHOST_DEL state.

Yes, that was me.

> I guess we still have this current issue on what is happening in the
> usb storage that it believes SCSI mid is still using the device. Is
> something not cleaning up, or is something in SCSI mid not honoring the
> SHOST_DEL state.

usb-storage checks the state of its kernel thread after calling
scsi_remove_host(), while preparing to kill the thread. This can only
be done while the thread is idle, not processing any queued commands or
error handler requests. The BUG in Alberto's log was triggered because
the thread was not idle. Unfortunately the log doesn't say whether it was
executing a queued command or an error handler request at the time.

It does appear to have been some sort of race, as Alberto mentioned in his
original message:

http://marc.theaimsgroup.com/?l=linux-usb-devel&m=108449593410567&w=2

It might not be easy to find out where the race is occurring.

Alan Stern