From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752776AbbJFTU1 (ORCPT ); Tue, 6 Oct 2015 15:20:27 -0400 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:54144 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752647AbbJFTUX (ORCPT ); Tue, 6 Oct 2015 15:20:23 -0400 Message-ID: <1444159196.10564.11.camel@HansenPartnership.com> Subject: Re: [PATCHv3 1/1] SCSI: update hosts module to use idr index management From: James Bottomley To: Lee Duncan Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Tejun Heo , Hannes Reinecke , Johannes Thumshirn , Christoph Hellwig Date: Tue, 06 Oct 2015 12:19:56 -0700 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2015-10-06 at 12:08 -0700, Lee Duncan wrote: > Update the SCSI hosts module to use idr to manage > its host_no index instead of an ATOMIC integer. This > also allows using idr_find() to look up the SCSI > host structure given the host number. > > This means that the SCSI host number will now > be reclaimable. > > Signed-off-by: Lee Duncan > Reviewed-by: Hannes Reinecke > --- > drivers/scsi/hosts.c | 61 ++++++++++++++++++++++++++-------------------------- > 1 file changed, 31 insertions(+), 30 deletions(- > > diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c > index 8bb173e01084..afe7bd962ddb 100644 > --- a/drivers/scsi/hosts.c > +++ b/drivers/scsi/hosts.c [...] > + spin_lock(&host_index_lock); > + shost = idr_find(&host_index_idr, hostnum); > + spin_unlock(&host_index_lock); > + > + return shost ? scsi_host_get(shost) : NULL; So the thing I don't like here is that there's a race between scsi_host_get() and the final put. What could happen is that idr_find() returns the host just before but scsi_host_dev_release() is executed before the return. In that instance, we'll reference freed memory in scsi_host_get() ... probably completely harmlessly, but it will show up occasionally on some of the traces ... particularly the ones doing a fuzz/stress test around host create/destroy. James