Re: [PATCH 2/2] scsi: don't use execute_in_process_context()

[Tejun Heo <tj@kernel.org>]

Hello,

On 12/15/2010 04:54 PM, James Bottomley wrote:
> On Wed, 2010-12-15 at 16:47 +0100, Tejun Heo wrote:
>> One way or the other, the current code is racy.  The module can go
>> away while the work is still running.  We'll have to add sync
>> interface for ew's, which conceptually is fine but is unnecessary with
>> the current code base.  Let's do it when it actually is necessary.
> 
> OK, ignoring the bickering over API, this is what I don't get.
> 
> The executed function releases the parent reference as its last call.
> That will cause the freeing of the embedded work item and a cascade
> release of all the parents.  If there's no more references, that will
> result in a final put of the module semaphore and rmmod will then
> proceed.  What is racy about that?  All the work structures and
> references have been freed before the module gets removed.  Nothing
> blocks the execution thread in the function, so it exits long before the
> code path gets zeroed.

Because the final put and return aren't atomic against module
unloading.  The worker can get preempted inbetween and the module can
be unloaded beneath it.  When the worker is scheduled back, its text,
which was inside the module, is gone.

To make that working, it either has to do the final put from the code
outside of the module (in another module or built-in) or the module
unloading should guarantee that the work item has finished executing
before proceeding with unload, which can only be done by flushing it
from outside the work itself.

Thanks.

-- 
tejun