Hi,

scsi_register_host() can in the error case _decrement_ the module usage 
counter of the scsi core module and it has a race with module unload during
bus scan.

        if (tpnt->present) {
                if (pcount == next_scsi_host) {
                        if (tpnt->present > 1) {
                                printk(KERN_ERR "scsi: Failure to register low-level 
scsi driver");
                                scsi_unregister_host(tpnt);
                                return 1;

This code calls scsi_unregister_host, which decrements module use count, 
without incrementing it beforehand.

In addition, it potentially allocates memory, starts and waits for the error 
handling thread and does io to scan the bus without having incremented the 
module usage counter.

Doing the increment earlier should fix it.
That the attached patch does.
Unless I am wrong, it should go in quickly.

        Regards
                Oliver


--- drivers/scsi/scsi.c.alt	Wed May  2 06:39:16 2001
+++ drivers/scsi/scsi.c	Wed May  2 06:46:21 2001
@@ -1826,6 +1826,8 @@
 	   using the new scsi code. NOTE: the detect routine could
 	   redefine the value tpnt->use_new_eh_code. (DB, 13 May 1998) */
 
+        MOD_INC_USE_COUNT;
+
 	if (tpnt->use_new_eh_code) {
 		spin_lock_irqsave(&io_request_lock, flags);
 		tpnt->present = tpnt->detect(tpnt);
@@ -1947,8 +1949,6 @@
 	       (scsi_init_memory_start - scsi_memory_lower_value) / 1024,
 	       (scsi_memory_upper_value - scsi_init_memory_start) / 1024);
 #endif
-
-	MOD_INC_USE_COUNT;
 
 	if (out_of_space) {
 		scsi_unregister_host(tpnt);	/* easiest way to clean up?? */

Reply via email to