Re: [PATCH] Fix reference counting for failed SCSI devices

Hannes Reinecke
2005-05-25T06:55:20Z

[-- Attachment #1: Type: text/plain, Size: 2168 bytes --]

James Bottomley wrote:
> On Tue, 2005-05-24 at 11:38 +0200, Hannes Reinecke wrote:
>>whenever the scsi-ml tries to scan non-existent devices the reference
>>count in scsi_alloc_sdev() and scsi_probe_and_add_lun() is not adjusted
>>properly. Every call to XXX_initialize in the driver core sets the
>>reference count to 1, so for a proper deallocation an explicit XXX_put()
>>has to be done.
>
> That's true, but I don't see what the problem is if the device has never
> been made visible.
>
It's not visible but it's still allocated and referenced. So on doing a
rmmod these class_devices are being deallocated which crashes as the
class device is not connected properly.

>>+ put_device(&starget->dev);
>
> this would amount to a double put, since the parent put method is called
> in the device release.
>
Oops. Correct.

>>+ class_device_put(&sdev->sdev_classdev);
>
> This is unnecessary since the class device is simply occupying a private
> area in the scsi_device. As long as its never made visible to the
> system, its refcount is irrelevant
>
It's not. Whenever you try to rmmod the adapter it becomes highly
relevant. If it doesn't crash you've at least generated a memleak as the
class device is never freed.
(And these are quite a few for Wide-SCSI Double-channel adapters ...)

>> put_device(&sdev->sdev_gendev);
>> out:
>> if (display_failure_msg)
>>@@ -855,6 +857,8 @@ static int scsi_probe_and_add_lun(struct
>> if (sdev->host->hostt->slave_destroy)
>> sdev->host->hostt->slave_destroy(sdev);
>> transport_destroy_device(&sdev->sdev_gendev);
>>+ class_device_put(&sdev->sdev_classdev);
>>+ put_device(sdev->sdev_gendev.parent);
>
> same should apply here. As long as this cascade occurs before
> scsi_add_lun() (which calls scsi_sysfs_add_sdev()), which is what makes
> the whole set of devices and classes visible.
>
Correct for the parent device. The class device has to be deallocated
properly if a rmmod should work properly.

New patch attached. Please apply.

Cheers,

Hannes
--
Dr. Hannes Reinecke hare@suse.de
SuSE Linux AG S390 & zSeries
Maxfeldstraße 5 +49 911 74053 688
90409 Nürnberg http://www.suse.de

[-- Attachment #2: linux-2.6.12-rc4-scsi-scan-fix-refcount-on-fail --]
[-- Type: text/plain, Size: 1047 bytes --]

From: Hannes Reinecke <hare@suse.de>
Subject: Fix refcount for failed devices

When a non-present device is scanned it is not properly deregistered
from the driver core. Calling XXX_initialize() functions from the driver
core sets the reference count to 1, so for proper deallocation a
XXX_put() has to be issued.

--- linux-2.6.12-rc4/drivers/scsi/scsi_scan.c.orig 2005-05-24 10:26:46.000000000 +0200
+++ linux-2.6.12-rc4/drivers/scsi/scsi_scan.c 2005-05-24 10:55:52.000000000 +0200
@@ -282,6 +282,7 @@ static struct scsi_device *scsi_alloc_sd
out_device_destroy:
transport_destroy_device(&sdev->sdev_gendev);
scsi_free_queue(sdev->request_queue);
+ class_device_put(&sdev->sdev_classdev);
put_device(&sdev->sdev_gendev);
out:
if (display_failure_msg)
@@ -855,6 +856,7 @@ static int scsi_probe_and_add_lun(struct
if (sdev->host->hostt->slave_destroy)
sdev->host->hostt->slave_destroy(sdev);
transport_destroy_device(&sdev->sdev_gendev);
+ class_device_put(&sdev->sdev_classdev);
put_device(&sdev->sdev_gendev);
}