Re: [linux-usb-devel] Re: [OOPS, usbcore, releaseintf] 2.6.0-test10-mm1

[Alan Stern <stern@rowland.harvard.edu>]

On Tue, 9 Dec 2003, David Brownell wrote:

> Various folk have reported similar problems on system shutdown
> before, and the simple fix has been not to clean up so aggressively.
> 
> What puzzled me was that a normal "rmmod" wouldn't give the
> same symptoms -- but the same codepaths could oops in certain
> system shutdown scenarios.

In an earlier message I wrote that the HC driver couldn't unload so long
as the device usbfs was using held a reference to its bus.  I just did
some checking, and guess what: It can!

I looked at both the UHCI and OHCI drivers.  In their module_exit routines
they call pci_unregister_driver().  Without knowing how the PCI subsystem
works, I would assume this behaves like any other "deregister" routine in
the driver model and returns without waiting for any reference count to go
to 0 -- that's what release callbacks are for.

However, the module_exit routines _don't_ wait for the release callbacks.  
They just go right on ahead and exit.  Result: when the reference count 
eventually does go to 0 (when usbfs drops its last reference), the 
hcd_free routine is no longer present and you get an oops.

The proper fix would be to have each HC driver keep track of how many 
instances are allocated.  The module_exit routine must wait for that 
number to drop to 0 before returning.

Alan Stern