Re: [linux-usb-devel] Bug creating USB endpoints in 2.6.20.x (kernel bug 8198)

[Tejun Heo <htejun@gmail.com>]

[adding back linux-usb-devel.  please don't drop cc]
[also adding lkml and Greg K-H]

Chris Rankin wrote:
> --- Tejun Heo <htejun@gmail.com> wrote:
>> Okay, here's patch against 2.6.20.11.  Let's hope we're not chasing
>> something which is already fixed.
> 
> Hooray! The trick was to trace the "dev" file instead of the endpoint directory itself. The
> compressed oops is attached.

Alright, it took a lot of work but the winner is the "dev" node.  Gee...
We could have caught this earlier unless I forgot to print the name of
the last component in the initial debug patch.  Well, better late than
never.  :-(

Anyways, the problem is that the attribute "dev" is dynamically
allocated using kmalloc() in device_add() and freed immediately after
the file is removed in device_del().  It's basically assuming
immediate-disconnect but that apparently isn't true yet.

The dynamic allocation is to set the owner of the attribute to the owner
of the device being registered.  This is twisted in that the field is
added to work around sysfs/module lifetime problem but the workaround
itself is broken with regard to lifetime rules.  Aieeeeeeee...  This
sort of things are why I implemented immediate disconnect on sysfs in
the first place.

So, we can fix the problem Chris is seeing by breaking module unload (by
allowing it to unload too early).  It doesn't sound too hot but module
unloading race is much less likely than sysfs node deletion/open race.

Thanks.

-- 
tejun