From: Stefan Richter <stefanr@s5r6.in-berlin.de>
To: Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux1394-devel@lists.sourceforge.net
Subject: [git pull] FireWire fix
Date: Sat, 27 Aug 2011 12:42:56 +0200 [thread overview]
Message-ID: <20110827124256.0ca474ff@stein> (raw)
Linus, please pull from the fixes branch at
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git fixes
for a fix to a regression since v3.0-rc1. Thanks.
Chris Boot (1):
firewire: sbp2: fix panic after rmmod with slow targets
drivers/firewire/sbp2.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
commit 0278ccd9d53e07c4e699432b2fed9de6c56f506c
Author: Chris Boot <bootc@bootc.net>
Date: Mon Aug 22 21:38:38 2011 +0100
firewire: sbp2: fix panic after rmmod with slow targets
If firewire-sbp2 starts a login to a target that doesn't complete ORBs
in a timely manner (and has to retry the login), and the module is
removed before the operation times out, you end up with a null-pointer
dereference and a kernel panic.
[SR: This happens because sbp2_target_get/put() do not maintain
module references. scsi_device_get/put() do, but at occasions like
Chris describes one, nobody holds a reference to an SBP-2 sdev.]
This patch cancels pending work for each unit in sbp2_remove(), which
hopefully means there are no extra references around that prevent us
from unloading. This fixes my crash.
Signed-off-by: Chris Boot <bootc@bootc.net>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 41841a3..17cef86 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1198,6 +1198,10 @@ static int sbp2_remove(struct device *dev)
{
struct fw_unit *unit = fw_unit(dev);
struct sbp2_target *tgt = dev_get_drvdata(&unit->device);
+ struct sbp2_logical_unit *lu;
+
+ list_for_each_entry(lu, &tgt->lu_list, link)
+ cancel_delayed_work_sync(&lu->work);
sbp2_target_put(tgt);
return 0;
--
Stefan Richter
-=====-==-== =--- ==-==
http://arcgraph.de/sr/
next reply other threads:[~2011-08-27 10:43 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-27 10:42 Stefan Richter [this message]
-- strict thread matches above, loose matches on Subject: below --
2014-11-14 11:28 [git pull] FireWire fix Stefan Richter
2014-07-14 18:37 Stefan Richter
2012-10-10 18:55 Stefan Richter
2011-09-17 17:40 Stefan Richter
2011-08-15 14:01 [git pull] FireWire fixes Stefan Richter
2011-08-21 17:31 ` [git pull] FireWire fix Stefan Richter
2010-10-18 11:57 Stefan Richter
2010-06-08 12:46 Stefan Richter
2009-12-06 17:56 [git pull] FireWire updates post 2.6.32 Stefan Richter
2009-12-11 20:59 ` [git pull] FireWire fix Stefan Richter
2009-01-09 18:35 post 2.6.28 regression: device_initialize() now sleeps, and may fail without recovery strategy Stefan Richter
2009-01-09 19:49 ` [PATCH post 2.6.28] firewire: core: fix sleep in atomic context due to driver core change Stefan Richter
2009-01-09 21:17 ` Alan Cox
2009-01-09 21:54 ` Greg KH
2009-01-09 22:28 ` [git pull] FireWire fix Stefan Richter
2007-09-07 17:04 [GIT PULL] " Stefan Richter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110827124256.0ca474ff@stein \
--to=stefanr@s5r6.in-berlin.de \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux1394-devel@lists.sourceforge.net \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).