Re: 2.6.16-rc1 crash in scsi_target_reap_work

[Brian King <brking@us.ibm.com>]

James Bottomley wrote:
> On Fri, 2006-02-10 at 11:11 +0100, Olaf Hering wrote:
>>550 reboots without crash, with this patch reverted.
>>Will try the execute_in_process_context thing now.
> 
> I wouldn't bother ... because of the structure, the
> execute_in_process_context() patch must have the same bug, but the
> context check will make it much more difficult to hit.
> 
> Go back to the original and see if you can diagnose what is NULL and
> why.  The target is supposed to have a reference on the parent, so what
> was the parent in this case?  If it's a host, there's nothing I can
> think of that can produce the behaviour you see; if it's something else,
> like an rport or phy then we may have a transport class issue.

Taking a quick look at the scsi_target_reap_work patch that went in,
one of the things it changed in this regard was the fact that the
caller of scsi_target_reap always has a ref to the starget->dev, which
would have protected scsi_target_reap from ever releasing the
starget->dev. Since the actual remove work was moved to a workqueue,
the get and put that the callers of scsi_target_reap are doing is no longer
adding the same protection it was before.


-- 
Brian King
eServer Storage I/O
IBM Linux Technology Center