Messages in this thread | | | Date | Tue, 26 Nov 2013 18:26:54 -0800 | Subject | Re: [PATCH v2 04/10] PCI: Destroy pci dev only once | From | Yinghai Lu <> |
| |
On Tue, Nov 26, 2013 at 5:24 PM, Rafael J. Wysocki <rjw@rjwysocki.net> wrote: > > So assume pci_destroy_dev() is called twice in parallel for the same dev > by two different threads. Thread 1 does the atomic_inc_and_test() and > finds that it is OK to do the device_del() and put_device() which causes > the device object to be freed. Then thread 2 does the atomic_inc_and_test() > on the already freed device object and crashes the kernel. > thread2 should still hold one extra reference. that is in device_schedule_callback ==> sysfs_schedule_callback ==> kobject_get(kobj)
pci_destroy_dev for thread2 is called at this point.
and that reference will be released from sysfs_schedule_callback ==> kobject_put()...
Thanks
Yinghai
| |