Messages in this thread | | | Date | Fri, 7 Dec 2012 21:04:19 +0800 | Subject | Re: Race condition between driver_probe_device and device_shutdown | From | Ming Lei <> |
| |
On Fri, Dec 7, 2012 at 8:16 PM, Wedson Almeida Filho <wedsonaf@gmail.com> wrote: >> Because device_del() will put reference count of the parent, and the patch >> only focuses on race between probe/release and shutdown. > > Right. device_del() puts the reference count of the parent -- is it > guaranteed that device_del() won't ever reassign dev->parent though > (e.g., to NULL)? I don't think it is, so I think that patch should > also save the pointer to the parent and use it (instead of what > happens to be in than dev->parent) to release the lock and put the > ref. > >> As far as device_move() concerned, looks it might be a problem. >> The problem even exits on driver attach vs. device open/release, >> if device_move is called in open() and open() happens before driver >> attach completes. > > Yeah, the pattern of locking the parent followed by the device occurs > in a few places. It looks like they were added by Alan with commit > bf74ad5bc41727d5f2f1c6bedb2c1fac394de731. (And as Greg mentioned, > might be occurring often enough to merit being moved into a common > function.)
In fact, there is no shutdown callback defined for usb driver, so holding the parent lock in device_shutdown() might be removed.
> > I guess the question is whether the callee is allowed to call > device_move(), if not, we're good.
Not only the callee, and other contexts can change device->parent too. Looks rfcomm_tty_open() which calls device_move() is called in open() context, so the parent might be changed before unlock(dev->parent) in __driver_attach().
> >> Your concern on device_remove() might be correct. Also, I am wondering >> if we can walk the 'dpm_list' backwards for device shutdown, which should >> be simpler and more reasonable. > > How would that help?
device_pm_lock() can prevent device_move() from being running.
Thanks, -- Ming Lei
| |