Linux-2.6.0-test4: Kernel Panic in scsi_host_dev_release

Linux-2.6.0-test4: Kernel Panic in scsi_host_dev_release

[Dr. Ernst Molitor]

Dear James E.J. Bottomley, 

while Linux-2.6.0-test3 runs like a charm on my (testbed) box, I ran
into a kernel panic with Linux-2.6.0-test4 (and 2.6.0-test4-bk4). 

The call trace is:

scsi_host_dev_release
device_releases
kobject_cleanup
aha1542_detect
init_this_scsi_driver
do_initcalls
init_workqueues
init
init
kernel_thread_helper

The last line of the panic says: 
<0>Kernel Panic: Attempted to kill init!

Assuming the problem lies with the scsi subsystem, I thought you might
perhaps be able to pinpoint the problem. 

For what my small knowledge of kernel internals is worth, I looked into
the scsi_host_dev_release function new to drivers/scsi/hosts in
2.6.0-test4. This function receives a struct dev * and extracts an
Scsi_Host pointer from it via the dev_to_shost macro, which, in fact, is
syntactical sugar to the container_of macro. 

The predecessor of the scsi_host_dev_release function in 2.6.0-test3 was
scsi_free_shost (which had a parameter of type Scsi_Host *). 

The last line of both functions is identical: kfree is called with the
pointer shost. From a very superficial analysis, I would feel that
freeing *dev rather than *shost would be logical, but I might very well
be way off the real source of the panic I have seen.

If you'd like me to, I could provide the full kernel panic message
(since the system is far from booted when the panic occurrs, I don't
have any trace of this on my disks...). 

Kind regards, 

Yours 

Ernst Molitor

Re: Linux-2.6.0-test4: Kernel Panic in scsi_host_dev_release

[Mike Anderson]

Dr. Ernst Molitor [molitor@uni-bonn.de] wrote:
> Dear James E.J. Bottomley, 
> 
> while Linux-2.6.0-test3 runs like a charm on my (testbed) box, I ran
> into a kernel panic with Linux-2.6.0-test4 (and 2.6.0-test4-bk4). 
> 
> The call trace is:
> 
> scsi_host_dev_release
> device_releases
> kobject_cleanup
> aha1542_detect
> init_this_scsi_driver
> do_initcalls
> init_workqueues
> init
> init
> kernel_thread_helper

I believe the problem you are hitting is a bug in the code I added for a
doing a put on the parent in the release function. If a driver calls
scsi_register, but then has a problem in there detect where they need to
call scsi_unregister the parent pointer of the struct device may never
be set.

I you have time could you please try the patch below. I have compiled it
only. I will try to run it with a modified driver that will fail in
detect shortly.

> The last line of both functions is identical: kfree is called with the
> pointer shost. From a very superficial analysis, I would feel that
> freeing *dev rather than *shost would be logical, but I might very well
> be way off the real source of the panic I have seen.
> 

We need to kfree the shost as the struct device is contained inside the
scsi_host structure.

-andmike
--
Michael Anderson
andmike@us.ibm.com

 drivers/scsi/hosts.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

diff -puN drivers/scsi/hosts.c~scsi_host_dev_release-parent-fix drivers/scsi/hosts.c
--- qla-bleed-2.5/drivers/scsi/hosts.c~scsi_host_dev_release-parent-fix	Mon Aug 25 15:42:53 2003
+++ qla-bleed-2.5-andmike/drivers/scsi/hosts.c	Mon Aug 25 15:43:19 2003
@@ -158,7 +158,8 @@ static void scsi_host_dev_release(struct
 	scsi_proc_hostdir_rm(shost->hostt);
 	scsi_destroy_command_freelist(shost);
 
-	put_device(parent);
+	if (parent)
+		put_device(parent);
 	kfree(shost);
 }
 

_

Re: Linux-2.6.0-test4: Kernel Panic in scsi_host_dev_release

[Dr. Ernst Molitor]

Dear Michael Anderson, 

thank you very much for your kind e-mail message and the patch you've
written. 

On Tue, 2003-08-26 at 01:42, Mike Anderson wrote:
> I believe the problem you are hitting is a bug in the code I added for a
> doing a put on the parent in the release function. If a driver calls
> scsi_register, but then has a problem in there detect where they need to
> call scsi_unregister the parent pointer of the struct device may never
> be set.
> 
> I you have time could you please try the patch below. I have compiled it
> only. I will try to run it with a modified driver that will fail in
> detect shortly.
> 

My pleasure. Your patch fixes the problem I have seen - thank you very
much! Linux-2.6.3-test4 is up and running on the box I'm writing this
message on.
 
> 
> We need to kfree the shost as the struct device is contained inside the
> scsi_host structure.

I see, thank you very much for your kind explanation.

Best wishes and regards, 

Ernst