Objects allocated by xen_blkif_alloc come from the 'blkif_cache' kmem cache. This cache is destoyed when xen-blkif is unloaded so it is necessary to wait for the deferred free routine used for such objects to complete. This necessity was missed in commit 14855954f636 "xen-blkback: allow module to be cleanly unloaded". This patch fixes the problem by taking/releasing extra module references in xen_blkif_alloc/free() respectively.
Unified · Split
| @@ -171,6 +171,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid) · 170 unmodified lines | ||
| 171 | 171 | blkif->domid = domid; |
| 172 | 172 | atomic_set(&blkif->refcnt, 1); |
| 173 | 173 | init_completion(&blkif->drain_complete); |
| 174 | + | |
| 175 | + /* | |
| 176 | + * Because freeing back to the cache may be deferred, it is not | |
| 177 | + * safe to unload the module (and hence destroy the cache) until | |
| 178 | + * this has completed. To prevent premature unloading, take an | |
| 179 | + * extra module reference here and release only when the object | |
| 180 | + * has been freed back to the cache. | |
| 181 | + */ | |
| 182 | + __module_get(THIS_MODULE); | |
| 174 | 183 | INIT_WORK(&blkif->free_work, xen_blkif_deferred_free); |
| 175 | 184 | |
| 176 | 185 | return blkif; |
| @@ -320,6 +329,7 @@ static void xen_blkif_free(struct xen_blkif *blkif) · 143 unmodified lines | ||
| 320 | 329 | |
| 321 | 330 | /* Make sure everything is drained before shutting down */ |
| 322 | 331 | kmem_cache_free(xen_blkif_cachep, blkif); |
| 332 | + module_put(THIS_MODULE); | |
| 323 | 333 | } |
| 324 | 334 | |
| 325 | 335 | int __init xen_blkif_interface_init(void) |