Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965037AbVKHVrP (ORCPT ); Tue, 8 Nov 2005 16:47:15 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S965146AbVKHVrP (ORCPT ); Tue, 8 Nov 2005 16:47:15 -0500 Received: from stat9.steeleye.com ([209.192.50.41]:6879 "EHLO hancock.sc.steeleye.com") by vger.kernel.org with ESMTP id S965037AbVKHVrO (ORCPT ); Tue, 8 Nov 2005 16:47:14 -0500 Subject: Re: oops with USB Storage on 2.6.14 From: James Bottomley To: Patrick Mansfield Cc: "goggin, edward" , "'Rolf Eike Beer'" , "'Andrew Morton'" , Masanari Iida , linux-kernel@vger.kernel.org, linux-usb-devel@lists.sourceforge.net, linux-scsi@vger.kernel.org In-Reply-To: <20051108213306.GA25219@us.ibm.com> References: <1131484123.3270.36.camel@mulgrave> <20051108213306.GA25219@us.ibm.com> Content-Type: text/plain Date: Tue, 08 Nov 2005 16:45:54 -0500 Message-Id: <1131486354.3270.42.camel@mulgrave> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 (2.2.3-2.fc4) Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 899 Lines: 22 On Tue, 2005-11-08 at 13:33 -0800, Patrick Mansfield wrote: > I mean we get a ref to the sdev in the upper level driver opens, scan, and > sd flush. So where are we not getting a ref? > > Shouldn't the get be done at a higher level? Actually, no, because of the way we run the queues for the next command. If this is a sd_sync_cache() or something for the last possible command on the device, the process may have a reference to the device, but as soon as we call end_that_request_last(), they may be racing to release it. The bug is triggered when we get into scsi_next_command() with us holding the only remaining reference to the device. James - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/