Re: [PATCH v2 04/30] cxlflash: Fix potential oops following LUN removal

On Sep 21, 2015, at 7:11 AM, Tomas Henzl [off-list ref] wrote:
On 16.9.2015 23:27, Matthew R. Ochs wrote:

quoted

When a LUN is removed, the sdev that is associated with the LUN
remains intact until its reference count drops to 0. In order
to prevent an sdev from being removed while a context is still
associated with it, obtain an additional reference per-context
for each LUN attached to the context.
=20
This resolves a potential Oops in the release handler when a
dealing with a LUN that has already been removed.
=20
Signed-off-by: Matthew R. Ochs <redacted>
Signed-off-by: Manoj N. Kumar <redacted>
Suggested-by: Brian King <redacted>
---
drivers/scsi/cxlflash/superpipe.c | 36 =

++++++++++++++++++++++++------------

quoted

1 file changed, 24 insertions(+), 12 deletions(-)
=20

diff --git a/drivers/scsi/cxlflash/superpipe.c =

b/drivers/scsi/cxlflash/superpipe.c

quoted

index fa513ba..1fa4af6 100644

--- a/drivers/scsi/cxlflash/superpipe.c
+++ b/drivers/scsi/cxlflash/superpipe.c

@@ -880,6 +880,9 @@ static int _cxlflash_disk_detach(struct =

scsi_device *sdev,

quoted

			sys_close(lfd);
	}
=20
+	/* Release the sdev reference that bound this LUN to the context =

*/

quoted

+	scsi_device_put(sdev);
+

=20
I'm not sure here with the use if scsi_device_get+put, also I don't =

quite well

understand what you are going to fix here and how can it happen.
The scsi_device_get takes an additional module reference, so if used =

from

a module it shouldn't be held for a long time.

The issue here is that the user context needs to be bound to the device =
so that
in the event that device goes away, it doesn't completely go away until =
the user
context is done using it. Without it, it is possible to crash when the =
context is
being freed.

Essentially this is the same as incrementing the count when an open is =
performed
on the device. The device can be removed (and is hidden upon doing so) =
but is
not actually freed until the reference is resolved (close()).

Is it possible for a user to rmmod the czlflash module
after the disk attach function is called?

Not while a user is present.