> - The module is loaded by kerneld into memory
> - read_super() is called so MOD_INC_USE_COUNT is called
> _but_ MOD_INC_USE_COUNT is not atomic (look in
> /usr/include/module.h, there is a pointer dereference before the
> increment)
> During this non-atomic operation, before the increment occurs, we
> have a context switch (is this possible when we are in kernel code?)
> - kerneld see that the refcount of the module is 0 and removes it from
> memory
Context switches can occur only if the process blocks (goes to sleep).
Interrupts can occur in between instructions, but not context switches.
MOD_INC_USE_CNT only needs to worry about blocking operations.
However, there still are a number of places in the kernel where the
MOD_INC_USE_CNT is done too late -- one or more blocking operations are
performed before the increment. This would allow the possibility of a
module unloading while someone is still executing its code. In typical
fs code, the MOD_INC_USE_CNT should be the first statement in read_super
(and of course all error exits should properly decrement it.)
Regards,
Bill