[PATCH 1/1] scsi_host regression: fix scsi host leak

[PATCH 1/1] scsi_host regression: fix scsi host leak

[michaelc]

From: Mike Christie <michaelc@cs.wisc.edu>

In 2.6.25 we started using class_find_child instead of implementing
our own loop and lookup. The problem is that class_find_child would get a
reference to the host's device, then scsi_host_lookup would get an extra
reference to it when it called scsi_host_get().

In 2.6.26 we started using class_find_device, and this function also
gets a reference to the device, so we end up with an extra ref
and the host will not get released.

This patch is made against scsi-rc-fixes and adds a put_device to
balance the class_find_device() get. I kept the scsi_host_get in
scsi_host_lookup, because the target layer is using scsi_host_lookup
and it looks like it needs the SHOST_DEL check.

For 2.6.25 we need a similar patch, but instead of calling
put_device we have to call class_device_put() due to the differences
in the the driver model device/class_device between 2.6.25 and
2.6.26. I can send a patch for 2.6.25 in a seperate mail.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
---
 drivers/scsi/hosts.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 3690360..c6457bf 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -456,6 +456,10 @@ static int __scsi_host_match(struct device *dev, void *data)
  *
  * Return value:
  *	A pointer to located Scsi_Host or NULL.
+ *
+ *	The caller must do a scsi_host_put() to drop the reference
+ *	that scsi_host_get() took. The put_device() below dropped
+ *	the reference from class_find_device().
  **/
 struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
 {
@@ -463,9 +467,10 @@ struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
 	struct Scsi_Host *shost = ERR_PTR(-ENXIO);
 
 	cdev = class_find_device(&shost_class, &hostnum, __scsi_host_match);
-	if (cdev)
+	if (cdev) {
 		shost = scsi_host_get(class_to_shost(cdev));
-
+		put_device(cdev);
+	}
 	return shost;
 }
 EXPORT_SYMBOL(scsi_host_lookup);
-- 
1.5.4.1

Re: [PATCH 1/1] scsi_host regression: fix scsi host leak

[Mike Christie]

[-- Attachment #1: Type: text/plain, Size: 1307 bytes --]

michaelc@cs.wisc.edu wrote:
> From: Mike Christie <michaelc@cs.wisc.edu>
> 
> In 2.6.25 we started using class_find_child instead of implementing
> our own loop and lookup. The problem is that class_find_child would get a
> reference to the host's device, then scsi_host_lookup would get an extra
> reference to it when it called scsi_host_get().
> 
> In 2.6.26 we started using class_find_device, and this function also
> gets a reference to the device, so we end up with an extra ref
> and the host will not get released.
> 
> This patch is made against scsi-rc-fixes and adds a put_device to
> balance the class_find_device() get. I kept the scsi_host_get in
> scsi_host_lookup, because the target layer is using scsi_host_lookup
> and it looks like it needs the SHOST_DEL check.
> 
> For 2.6.25 we need a similar patch, but instead of calling
> put_device we have to call class_device_put() due to the differences
> in the the driver model device/class_device between 2.6.25 and
> 2.6.26. I can send a patch for 2.6.25 in a seperate mail.
> 

Attached is a patch for 2.6.25. Sorry it is late and attached instead of 
inlined. I can send it in a new thread if you want too. I just want to 
make sure people know it is slightly different from the scsi-rc-fixes 
patch because of the driver model changes.

[-- Attachment #2: fix-host-refcount.patch --]
[-- Type: text/plain, Size: 927 bytes --]

In 2.6.25 we started using class_find_child instead of implementing
our own loop and lookup. The problem is that class_find_child would get a
reference to the host's device, then scsi_host_lookup would get an extra
reference to it when it called scsi_host_get(). This patch drops the
ref from class_find_child because scsi_host_get gets a ref if the host
is not being removed.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>

--- linux-2.6.25.2/drivers/scsi/hosts.c	2008-05-06 18:21:32.000000000 -0500
+++ linux-2.6.25.2.work/drivers/scsi/hosts.c	2008-06-13 19:43:15.000000000 -0500
@@ -455,9 +455,10 @@ struct Scsi_Host *scsi_host_lookup(unsig
 	struct Scsi_Host *shost = ERR_PTR(-ENXIO);
 
 	cdev = class_find_child(&shost_class, &hostnum, __scsi_host_match);
-	if (cdev)
+	if (cdev) {
 		shost = scsi_host_get(class_to_shost(cdev));
-
+		class_device_put(cdev);
+	}
 	return shost;
 }
 EXPORT_SYMBOL(scsi_host_lookup);