From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753560Ab1HVW4T (ORCPT ); Mon, 22 Aug 2011 18:56:19 -0400 Received: from yuna.grokhost.net ([87.117.228.63]:36542 "EHLO yuna.grokhost.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751663Ab1HVW4R (ORCPT ); Mon, 22 Aug 2011 18:56:17 -0400 From: Chris Boot To: Stefan Richter , linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Cc: Chris Boot Subject: [PATCH] [v3] firewire-sbp2: fix panic after rmmod with slow targets Date: Mon, 22 Aug 2011 23:56:11 +0100 Message-Id: <1314053771-29944-1-git-send-email-bootc@bootc.net> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <811318C8-1FD9-4E67-8346-13CFB69A0AF8@bootc.net> References: <811318C8-1FD9-4E67-8346-13CFB69A0AF8@bootc.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If firewire-sbp2 starts a login to a target that doesn't complete ORBs in a timely manner (and has to retry the login), and the module is removed before the operation times out, you end up with a null-pointer dereference and a kernel panic. This happens because the code in sbp2_remove() just does a sbp2_target_put(), assuming there are no remaining references to the target. If there are jobs in the workqueue, this is not the case, and the module is successfully unloaded while references still exist. This patch cancels pending work for each unit in sbp2_remove(), which hopefully means there are no extra references around that prevent us from unloading. This fixes my crash. Signed-off-by: Chris Boot Cc: Stefan Richter Cc: --- drivers/firewire/sbp2.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c index 41841a3..260dd23 100644 --- a/drivers/firewire/sbp2.c +++ b/drivers/firewire/sbp2.c @@ -1198,6 +1198,11 @@ static int sbp2_remove(struct device *dev) { struct fw_unit *unit = fw_unit(dev); struct sbp2_target *tgt = dev_get_drvdata(&unit->device); + struct sbp2_logical_unit *lu; + + list_for_each_entry(lu, &tgt->lu_list, link) { + cancel_delayed_work_sync(&lu->work); + } sbp2_target_put(tgt); return 0; -- 1.7.5.4