[PATCH] mtd: use refcount to prevent corruption

[Winkler, Tomas]

> 
> Tomas,
> 
> ----- Ursprüngliche Mail -----
> >> As Richard was saying, we are really open to enhance MTD refcounting.
> >>
> >> However, the issue you are facing is, IMHO, not related to MTD but to MFD.
> >> There should be a way to avoid MFD to vanish by taking a reference of
> >> it through mtd->_get_device(). I don't think addressing the case
> >> where MFD vanishes while MTD (as a user) is still active is the right
> approach.
> >
> > I think it won't work because MFD sub-driver remove() is called   and it must
> > succeed because the main device  is not accessible unlike glueubi
> > which just returns -EBUSY.
> 
> Well, the trick in glubi (and other MTDs with "hotplug" support) is not to reject
> removal of the sub-device. ->_put_device() is of return type void.
> The key is grabbing a reference on the sub-device in ->_get_device() such that
> the layer below doesn't even try to remove while the MTD is in use.
> 
> > so we postpone the mtd unregister to  mtd_info->_put_device()  but it
> > that state we have nothing to hold on as the device is gone in
> > remove() User will fail anyway, as the underlying device is not
> > functional in that state.
> > Anyway I've tried your suggestion, the kernel is crashing, hope I
> > haven't done some silly bug.
> 
> Can you point us to the affected code?
> This would help a lot to understand the issue better.
Below is approximately the snippet 

> I'm sure we can find a solution.
Okay though  I've already found a working solution. 

struct my_spi {
        struct mtd_info mtd;
        struct kref refcnt;
        bool init;
};

static int my_spi_get_mtd(struct mtd_info *mtd)
{
        struct my_spi *spi = container_of(mtd, struct my_spi, mtd);

        if (!spi->init)
                return -ENODEV;

        kref_get(&spi->refcnt);

        spi->init = true;

        return 0;
}

static void my_spi_unregister_mtd(struct kref *kref)
{
        struct my_spi *spi = container_of(kref, struct my_spi, refcnt);

        mtd_device_unregister(&spi->mtd);
        kfree(spi);
}

static int my_spi_put_mtd(struct mtd_info *mtd)
{
        struct my_spi *spi = container_of(mtd, struct my_spi, mtd);

        kref_put(&spi->refcnt, my_spi_unregister_mtd);

        return 0;
}

static int my_spi_init_mtd(static my_spi *spi)
{
        ...
        spi->mtd._get_device = my_spi_get_mtd;
        spi->mtd._get_device = my_spi_put_mtd;
        kref_init(&spi->refcnt);
        ...
}

static int my_spi_probe(struct platform_device *platdev)
{
        ...
        spi = kzalloc(size, GFP_KERNEL);
        spi->init = true;
        my_spi_init_mtd(spi);
        platform_set_drvdata(platdev, spi);
        ...
        return 0;
}


static int my_spi_remove(struct platform_device *platdev)
{
        struct my_spi *spi = platform_get_drvdata(platdev);
        spi->init = false;
        my_spi_put_mtd(&spi->mtd);
        platform_set_drvdata(platdev, NULL);
}