[ofa-general] Race condition in core/sysfs.c (kernel panic) when unloading the driver

[Jack Morgenstein]

On Monday 23 February 2009 06:40, Roland Dreier wrote:
> Oh I see... we leave the sysfs stuff around way too long, since we want
> to use it for tracking the lifetime of our class device.  the patch
> below fixes things for me here... there's still room for substantial
> cleanup but I think this gets the crashes fixed at least:
> 
I'm not sure that it does.  This does not make sysfs access atomic wrt module unloading.
I think an app can still lose it's timeslice while inside the sysfs access, and module
unload can still occur while the app is waiting for a new time slice (although the code pages
will not be removed as yet -- see below).

While the module code pages will still be available, what prevents module cleanup from
deleting all the module's resources?  In this case, the app will succeed in invoking
the low-level driver (its code is still loaded), but may cause an Oops when that low-level
driver code attempts to access low-level driver data structures (which have been freed).

What about the patch I just submitted?
        http://lists.openfabrics.org/pipermail/general/2009-February/057565.html

([ofa-general] [PATCH] ib_core: avoid race condition between sysfs access and low-level module unload)

- Jack