Messages in this thread |  | | Subject | Re: [PATCH] scsi: avoid use of reclaimed reference | From | James Bottomley <> | Date | Tue, 12 Nov 2013 22:46:42 -0800 |
| |
On Tue, 2013-11-12 at 18:09 -0800, David Decotigny wrote: > I was considering the following scenario wherein the "if > (scsi_device_created(sdev))" test at the end would test garbage at > best (or unmapped data):
Well, no, the counting isn't right:
> if (!(sdev = scsi_device_lookup_by_target(starget, 0))) { // not found > sdev = scsi_alloc_sdev(starget, 0, NULL); // -> ref cnt = 2
1
> if (scsi_device_get(sdev)) { // -> ref cnt = 3
2
> } > ... > } > ... > res = scsi_probe_and_add_lun(starget, // -> > ref cnt = 1
No idea what you think here, where were the other puts? If starget,lun is sdev, then the count goes to 3 here otherwise it stays at 2 if it isn't reported in the scan. ... > scsi_device_put(sdev); // -> reclaimed
No, it goes to either 2 or 1 here. If it goes to 1 it's because the sdev was never probed and thus it remains in the created state.
> if (scsi_device_created(sdev)) // test on garbage or unmapped data (#PF)
Which means this test passes and it gets garbage collected by __scsi_remove_device(). Otherwise we exit with refcount 2.
James
|  |