Messages in this thread | | | Subject | Re: [PATCH v3 3/3] uio: fix crash after the device is unregistered | From | Mike Christie <> | Date | Mon, 9 Jul 2018 11:40:19 -0500 |
| |
On 07/06/2018 08:47 PM, Xiubo Li wrote: > On 2018/7/7 2:58, Mike Christie wrote: >> On 07/05/2018 09:57 PM, xiubli@redhat.com wrote: >>> void uio_event_notify(struct uio_info *info) >>> { >>> - struct uio_device *idev = info->uio_dev; >>> + struct uio_device *idev; >>> + >>> + if (!info) >>> + return; >>> + >>> + idev = info->uio_dev; >>> >> For this one too, I am not sure if it is needed. >> >> uio_interrupt -> uio_event_notify. See other mail. >> >> driver XYZ -> uio_event_notify. I think drivers need to handle this and >> set some bits and/or perform some cleanup to make sure they are not >> calling uio_event_notify after it has called uio_unregister_device. The >> problem with the above test is if they do not they could have called >> uio_unregister_device right after the info test so you could still hit >> the problem. > > When we are tcmu_destroy_device(), if the netlink notify event to > userspace is not successful then the TCMU will call the uio unregister, > which will set the idev->info = NULL, without close and deleting the > device in userspace. But the TCMU could still queue cmds to the ring > buffer, then the uio_event_notify will be called.
Before tcmu_destroy_device is called LIO will have stopped new IO and waited for outstanding IO to be completed, so it would never be called after uio_unregister_device. If it does, it's a bug in LIO.
| |