Re: [PATCH] Kobjects: drop child->parent ref at unregistration

[Alan Stern]

On Mon, 26 Nov 2007, Andrew Morton wrote:

> On Mon, 19 Nov 2007 10:53:40 -0500 (EST)
> Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> wrote:
> 
> > This patch (as1015) reverts changes that were made to the driver core
> > about four years ago.  The intent back then was to avoid certain kinds
> > of invalid memory accesses by leaving kernel objects allocated as long
> > as any of their children were still allocated.  The original and
> > correct approach was to wait only as long as any children were still
> > _registered_; that's what this patch reinstates.
> 
> What happened with this?

As far as I know, it's on Greg's queue.

> > This fixes a problem in the SCSI core made visible by the class_device
> > to regular device conversion: A reference loop (scsi_device holds
> > reference to request_queue, which is the child of a gendisk, which is
> > the child of the scsi_device) prevents the data structures from being
> > released, even though they are deregistered okay.
> > 
> > It's possible that this change will cause a few bugs to surface,
> > things that have been hidden for several years.  They can be fixed
> > easily enough by having the child device take an explicit reference to
> > the parent whenever needed.
> > 
> 
> How will such bugs manifest?  Ideally via a nice printk and a stack trace
> followed by damage avoidance.

They will manifest in the same way as any other use-after-free bug: an 
oops message and either death of the current process or a system hang.

Obviously I'm not aware of any such bugs -- if I were, I'd fix them.  
Greg has expressed concern that some USB serial drivers might have this 
problem.  I'll do what testing I can (not much because I don't have any 
USB serial devices).

> If it's via a mysterious crash or something similarly obscure then can we
> improve that?

I can't think of anything offhand.  Maybe someone else can.

Alan Stern

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/