@@ -93,9 +93,31 @@ static void mtd_release(struct device *dev)
dev_t index = MTD_DEVT(mtd->index);
/* remove /dev/mtdXro node */
+ if (mtd_is_partition(mtd))
+ release_mtd_partition(mtd);
+
device_destroy(&mtd_class, index + 1);
}
+static void mtd_device_release(struct kref *kref)
+{
+ struct mtd_info *mtd = container_of(kref, struct mtd_info, refcnt);
+
+ pr_debug("%s %s\n", __func__, mtd->name);
+
+ if (mtd->nvmem) {
+ nvmem_unregister(mtd->nvmem);
+ mtd->nvmem = NULL;
+ }
+
+ idr_remove(&mtd_idr, mtd->index);
+ of_node_put(mtd_get_of_node(mtd));
+
+ device_unregister(&mtd->dev);
+
+ module_put(THIS_MODULE);
+}
+
static ssize_t mtd_type_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -619,7 +641,7 @@ int add_mtd_device(struct mtd_info *mtd)
}
mtd->index = i;
- mtd->usecount = 0;
+ kref_init(&mtd->refcnt);
/* default value if not set by driver */
if (mtd->bitflip_threshold == 0)
@@ -719,6 +741,8 @@ int del_mtd_device(struct mtd_info *mtd)
int ret;
struct mtd_notifier *not;
+ pr_debug("%s %s\n", __func__, mtd->name);
+
mutex_lock(&mtd_table_mutex);
debugfs_remove_recursive(mtd->dbg.dfs_dir);
@@ -733,23 +757,8 @@ int del_mtd_device(struct mtd_info *mtd)
list_for_each_entry(not, &mtd_notifiers, list)
not->remove(mtd);
- if (mtd->usecount) {
- printk(KERN_NOTICE "Removing MTD device #%d (%s) with use count %d\n",
- mtd->index, mtd->name, mtd->usecount);
- ret = -EBUSY;
- } else {
- /* Try to remove the NVMEM provider */
- if (mtd->nvmem)
- nvmem_unregister(mtd->nvmem);
-
- device_unregister(&mtd->dev);
-
- idr_remove(&mtd_idr, mtd->index);
- of_node_put(mtd_get_of_node(mtd));
-
- module_put(THIS_MODULE);
- ret = 0;
- }
+ kref_put(&mtd->refcnt, mtd_device_release);
+ ret = 0;
out_error:
mutex_unlock(&mtd_table_mutex);
@@ -984,20 +993,23 @@ int __get_mtd_device(struct mtd_info *mtd)
if (!try_module_get(master->owner))
return -ENODEV;
+ kref_get(&mtd->refcnt);
+ pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt));
+
if (master->_get_device) {
err = master->_get_device(mtd);
if (err) {
+ kref_put(&mtd->refcnt, mtd_device_release);
module_put(master->owner);
return err;
}
}
- master->usecount++;
-
while (mtd->parent) {
- mtd->usecount++;
mtd = mtd->parent;
+ kref_get(&mtd->refcnt);
+ pr_debug("get mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt));
}
return 0;
@@ -1055,14 +1067,15 @@ void __put_mtd_device(struct mtd_info *mtd)
{
struct mtd_info *master = mtd_get_master(mtd);
+ kref_put(&mtd->refcnt, mtd_device_release);
+ pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt));
+
while (mtd->parent) {
- --mtd->usecount;
- BUG_ON(mtd->usecount < 0);
mtd = mtd->parent;
+ kref_put(&mtd->refcnt, mtd_device_release);
+ pr_debug("put mtd %s %d\n", mtd->name, kref_read(&mtd->refcnt));
}
- master->usecount--;
-
if (master->_put_device)
master->_put_device(master);
@@ -12,6 +12,7 @@ int __must_check add_mtd_device(struct mtd_info *mtd);
int del_mtd_device(struct mtd_info *mtd);
int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
int del_mtd_partitions(struct mtd_info *);
+void release_mtd_partition(struct mtd_info *mtd);
struct mtd_partitions;
@@ -27,10 +27,17 @@
static inline void free_partition(struct mtd_info *mtd)
{
+ pr_err("free_partition \"%s\"\n", mtd->name);
kfree(mtd->name);
kfree(mtd);
}
+void release_mtd_partition(struct mtd_info *mtd)
+{
+ list_del_init(&mtd->part.node);
+ free_partition(mtd);
+}
+
static struct mtd_info *allocate_partition(struct mtd_info *parent,
const struct mtd_partition *part,
int partno, uint64_t cur_offset)
@@ -313,9 +320,6 @@ static int __mtd_del_partition(struct mtd_info *mtd)
if (err)
return err;
- list_del(&child->part.node);
- free_partition(mtd);
-
return 0;
}
@@ -341,9 +345,6 @@ static int __del_mtd_partitions(struct mtd_info *mtd)
err = ret;
continue;
}
-
- list_del(&child->part.node);
- free_partition(child);
}
return err;
@@ -373,7 +373,7 @@ struct mtd_info {
struct module *owner;
struct device dev;
- int usecount;
+ struct kref refcnt;
struct mtd_debug_info dbg;
struct nvmem_device *nvmem;
When underlying device is removed mtd core will crash in case user space is holding open handle. Need to use proper refcounting so device is release only when has no users. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> --- drivers/mtd/mtdcore.c | 63 +++++++++++++++++++++++++---------------- drivers/mtd/mtdcore.h | 1 + drivers/mtd/mtdpart.c | 13 +++++---- include/linux/mtd/mtd.h | 2 +- 4 files changed, 47 insertions(+), 32 deletions(-)