OOPS on module unload 2.5.47-mm1

OOPS on module unload 2.5.47-mm1

[Badari Pulavarty]

Hi,

I get following panic while rmmod qla driver.  (2.5.47-mm1).

Is this a known problem ? Any ideas ?

Thanks,
Badari


Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Synchronizing SCSI cache: 
Unable to handle kernel paging request at virtual address 5a5a5a5e
 printing eip:
c025ea85
*pde = 00000000
Oops: 0002
qla2200  
CPU:    0
EIP:    0060:[<c025ea85>]    Not tainted
EFLAGS: 00010287
EIP is at __blk_cleanup_queue+0x25/0x70
eax: 5a5a5a5a   ebx: d31c8c94   ecx: d23ab5ac   edx: d31c8c94
esi: 000001ab   edi: d31c8c90   ebp: d302f000   esp: d2eebf28
ds: 0068   es: 0068   ss: 0068
Process rmmod (pid: 2708, threadinfo=d2eea000 task=d2e48180)
Stack: 00000800 d2f60000 d31c8c2c c025eae7 d31c8c90 d31c8c00 f89424c0 c02960d9 
       d31c8c2c d2f60000 00000006 c0295f22 d2f60000 d2a44000 c0295f10 c0295e2d 
       d2f60000 00000006 d2eea000 00000000 c029694e f89424c0 c0295f10 f8915000 
Call Trace:
 [<c025eae7>] blk_cleanup_queue+0x17/0x60
 [<f89424c0>] driver_template+0x0/0x68 [qla2200]
 [<c02960d9>] scsi_remove_host+0x179/0x1b0
 [<c0295f22>] scsi_remove_legacy_host+0x12/0x50
 [<c0295f10>] scsi_remove_legacy_host+0x0/0x50
 [<c0295e2d>] scsi_tp_for_each_host+0x7d/0x110
 [<c029694e>] scsi_unregister_host+0x6e/0xf0
 [<f89424c0>] driver_template+0x0/0x68 [qla2200]
 [<c0295f10>] scsi_remove_legacy_host+0x0/0x50
 [<f8929aba>] exit_this_scsi_driver+0xa/0x10 [qla2200]
 [<f89424c0>] driver_template+0x0/0x68 [qla2200]
 [<c012081e>] free_module+0x1e/0x130
 [<c011faa4>] sys_delete_module+0x1b4/0x410
 [<c0109173>] syscall_call+0x7/0xb

Code: 89 50 04 89 02 89 09 89 49 04 51 8b 0d 0c 43 5c c0 46 51 e8 

Re: OOPS on module unload 2.5.47-mm1

[Jens Axboe]

On Tue, Nov 12 2002, Badari Pulavarty wrote:
> Hi,
> 
> I get following panic while rmmod qla driver.  (2.5.47-mm1).
> 
> Is this a known problem ? Any ideas ?
> 
> Thanks,
> Badari
> 
> 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Synchronizing SCSI cache: 
> Unable to handle kernel paging request at virtual address 5a5a5a5e
>  printing eip:
> c025ea85
> *pde = 00000000
> Oops: 0002
> qla2200  
> CPU:    0
> EIP:    0060:[<c025ea85>]    Not tainted
> EFLAGS: 00010287
> EIP is at __blk_cleanup_queue+0x25/0x70
> eax: 5a5a5a5a   ebx: d31c8c94   ecx: d23ab5ac   edx: d31c8c94
> esi: 000001ab   edi: d31c8c90   ebp: d302f000   esp: d2eebf28
> ds: 0068   es: 0068   ss: 0068
> Process rmmod (pid: 2708, threadinfo=d2eea000 task=d2e48180)
> Stack: 00000800 d2f60000 d31c8c2c c025eae7 d31c8c90 d31c8c00 f89424c0 c02960d9 
>        d31c8c2c d2f60000 00000006 c0295f22 d2f60000 d2a44000 c0295f10 c0295e2d 
>        d2f60000 00000006 d2eea000 00000000 c029694e f89424c0 c0295f10 f8915000 
> Call Trace:
>  [<c025eae7>] blk_cleanup_queue+0x17/0x60
>  [<f89424c0>] driver_template+0x0/0x68 [qla2200]
>  [<c02960d9>] scsi_remove_host+0x179/0x1b0
>  [<c0295f22>] scsi_remove_legacy_host+0x12/0x50
>  [<c0295f10>] scsi_remove_legacy_host+0x0/0x50
>  [<c0295e2d>] scsi_tp_for_each_host+0x7d/0x110
>  [<c029694e>] scsi_unregister_host+0x6e/0xf0
>  [<f89424c0>] driver_template+0x0/0x68 [qla2200]
>  [<c0295f10>] scsi_remove_legacy_host+0x0/0x50
>  [<f8929aba>] exit_this_scsi_driver+0xa/0x10 [qla2200]
>  [<f89424c0>] driver_template+0x0/0x68 [qla2200]
>  [<c012081e>] free_module+0x1e/0x130
>  [<c011faa4>] sys_delete_module+0x1b4/0x410
>  [<c0109173>] syscall_call+0x7/0xb
> 
> Code: 89 50 04 89 02 89 09 89 49 04 51 8b 0d 0c 43 5c c0 46 51 e8 

Hmm, look as if the rq on the freelist has already been free'ed. But if
it had, it shouldn't be on the list. At least there's a small bug there,
the elevator_exit() needs to be before the __blk_cleanup_queue() calls
in blk_cleanup_queue().

Maybe try dumping blk_init_queue() and blk_cleanup_queue() calls to see
if they match up?

-- 
Jens Axboe

Re: OOPS on module unload 2.5.47-mm1

[Patrick Mansfield]

On Tue, Nov 12, 2002 at 03:49:40PM -0800, Badari Pulavarty wrote:
> Hi,
> 
> I get following panic while rmmod qla driver.  (2.5.47-mm1).
> 
> Is this a known problem ? Any ideas ?
> 
> Thanks,
> Badari

Badari -

Here are four patches, 3 in sysfs, one in scsi, that I used to enable
rmmod/insmod of qla and scsi_debug without problems in 2.5.46 or so.
I have not tried running 2.5.47-mm1 or 2.5.47 with these, but these
patches still apply against current bk (nov 13). I don't remember all
the odd behaviour seen without them, generally use-after-freed problems.

I'm not sure about the sysfs ones, but the scsi one is fine for now
(exporting the SCSI type is not very useful, we need a common scsi_device
removal/cleanup function where we can remove scsi_device sysfs attribute
files. Generally, scsi use of sysfs is broken.)

I posted these to linux-scsi, Mike A posted the sysfs ones to linux-kernel.

--- 1.22/drivers/base/bus.c	Thu Oct 31 08:20:23 2002
+++ edited/drivers/base/bus.c	Wed Nov  6 17:03:24 2002
@@ -209,8 +209,10 @@
 				attach(dev);
 			else
 				dev->driver = NULL;
-		} else 
+		} else  {
 			attach(dev);
+			error = 0;
+		}
 	}
 	return error;
 }
===== drivers/base/core.c 1.50 vs edited =====
--- 1.50/drivers/base/core.c	Thu Oct 31 08:20:23 2002
+++ edited/drivers/base/core.c	Wed Nov  6 17:03:42 2002
@@ -173,8 +173,6 @@
 		return -EINVAL;
 
 	device_initialize(dev);
-	if (dev->parent)
-		get_device(dev->parent);
 	error = device_add(dev);
 	if (error && dev->parent)
 		put_device(dev->parent);
===== drivers/base/driver.c 1.14 vs edited =====
--- 1.14/drivers/base/driver.c	Wed Oct 30 16:35:48 2002
+++ edited/drivers/base/driver.c	Wed Nov  6 16:44:13 2002
@@ -127,6 +127,8 @@
 	drv->present = 0;
 	spin_unlock(&device_lock);
 	pr_debug("driver %s:%s: unregistering\n",drv->bus->name,drv->name);
+	bus_remove_driver(drv);
+	kobject_unregister(&drv->kobj);
 	put_driver(drv);
 }
 
--- 1.33/drivers/scsi/scsi_scan.c	Wed Nov  6 11:46:48 2002
+++ edited/drivers/scsi/scsi_scan.c	Wed Nov  6 17:04:56 2002
@@ -307,73 +307,6 @@
 }
 
 /**
- * scsi_device_type_read - copy out the SCSI type
- * @driverfs_dev:	driverfs device to check
- * @page:		copy data into this area
- * @count:		number of bytes to copy
- * @off:		start at this offset in page
- *
- * Description:
- *     Called via driverfs when the "type" (in scsi_device_type_file)
- *     field is read. Copy the appropriate SCSI type string into @page,
- *     followed by a newline and a '\0'. Go through gyrations so we don't
- *     write more than @count, and we don't write past @off.
- *
- * Notes:
- *     This is for the top-most scsi entry in driverfs, the upper-level
- *     drivers have their own type file. XXX This is not part of scanning,
- *     other than we reference the attr struct in this file, move to
- *     scsi.c or scsi_lib.c.
- *
- * Return:
- *     number of bytes written into page.
- **/
-static ssize_t scsi_device_type_read(struct device *driverfs_dev, char *page,
-	size_t count, loff_t off)
-{
-	struct scsi_device *sdev = to_scsi_device(driverfs_dev);
-	const char *type;
-	size_t size, len;
-
-	if ((sdev->type > MAX_SCSI_DEVICE_CODE) ||
-	    (scsi_device_types[(int)sdev->type] == NULL))
-		type = "Unknown";
-	else
-		type = scsi_device_types[(int)sdev->type];
-	size = strlen(type);
-	/*
-	 * Check if off is past size + 1 for newline + 1 for a '\0'.
-	 */
-	if (off >= (size + 2))
-		return 0;
-	if (size > off) {
-		len = min((size_t) (size - off), count);
-		memcpy(page + off, type + off, len);
-	} else
-		len = 0;
-	if (((len + off) == size) && (len < count))
-		/*
-		 * We are at the end of the string and have space, add a
-		 * new line.
-		 */
-		*(page + off + len++) = '\n';
-	if (((len + off) == (size + 1)) && (len < count))
-		/*
-		 * We are past the newline and have space, add a
-		 * terminating '\0'.
-		 */
-		*(page + off + len++) = '\0';
-	return len;
-}
-
-/*
- * Create dev_attr_type. This is different from the dev_attr_type in scsi
- * upper level drivers.
- */
-static DEVICE_ATTR(type,S_IRUGO,scsi_device_type_read,NULL);
-
-
-/**
  * print_inquiry - printk the inquiry information
  * @inq_result:	printk this SCSI INQUIRY
  *
@@ -1439,11 +1372,6 @@
 	sdev->sdev_driverfs_dev.parent = &sdev->host->host_driverfs_dev;
 	sdev->sdev_driverfs_dev.bus = &scsi_driverfs_bus_type;
 	device_register(&sdev->sdev_driverfs_dev);
-
-	/*
-	 * Create driverfs file entries
-	 */
-	device_create_file(&sdev->sdev_driverfs_dev, &dev_attr_type);
 
 	sprintf(devname, "host%d/bus%d/target%d/lun%d",
 		sdev->host->host_no, sdev->channel, sdev->id, sdev->lun);

Re: OOPS on module unload 2.5.47-mm1

[Badari Pulavarty]

Patrick,

Your patches fixed my problem. 

Thanks,
Badari

> 
> On Tue, Nov 12, 2002 at 03:49:40PM -0800, Badari Pulavarty wrote:
> > Hi,
> > 
> > I get following panic while rmmod qla driver.  (2.5.47-mm1).
> > 
> > Is this a known problem ? Any ideas ?
> > 
> > Thanks,
> > Badari
> 
> Badari -
> 
> Here are four patches, 3 in sysfs, one in scsi, that I used to enable
> rmmod/insmod of qla and scsi_debug without problems in 2.5.46 or so.
> I have not tried running 2.5.47-mm1 or 2.5.47 with these, but these
> patches still apply against current bk (nov 13). I don't remember all
> the odd behaviour seen without them, generally use-after-freed problems.
> 
> I'm not sure about the sysfs ones, but the scsi one is fine for now
> (exporting the SCSI type is not very useful, we need a common scsi_device
> removal/cleanup function where we can remove scsi_device sysfs attribute
> files. Generally, scsi use of sysfs is broken.)
> 
> I posted these to linux-scsi, Mike A posted the sysfs ones to linux-kernel.
> 
> --- 1.22/drivers/base/bus.c	Thu Oct 31 08:20:23 2002
> +++ edited/drivers/base/bus.c	Wed Nov  6 17:03:24 2002
> @@ -209,8 +209,10 @@
>  				attach(dev);
>  			else
>  				dev->driver = NULL;
> -		} else 
> +		} else  {
>  			attach(dev);
> +			error = 0;
> +		}
>  	}
>  	return error;
>  }
> ===== drivers/base/core.c 1.50 vs edited =====
> --- 1.50/drivers/base/core.c	Thu Oct 31 08:20:23 2002
> +++ edited/drivers/base/core.c	Wed Nov  6 17:03:42 2002
> @@ -173,8 +173,6 @@
>  		return -EINVAL;
>  
>  	device_initialize(dev);
> -	if (dev->parent)
> -		get_device(dev->parent);
>  	error = device_add(dev);
>  	if (error && dev->parent)
>  		put_device(dev->parent);
> ===== drivers/base/driver.c 1.14 vs edited =====
> --- 1.14/drivers/base/driver.c	Wed Oct 30 16:35:48 2002
> +++ edited/drivers/base/driver.c	Wed Nov  6 16:44:13 2002
> @@ -127,6 +127,8 @@
>  	drv->present = 0;
>  	spin_unlock(&device_lock);
>  	pr_debug("driver %s:%s: unregistering\n",drv->bus->name,drv->name);
> +	bus_remove_driver(drv);
> +	kobject_unregister(&drv->kobj);
>  	put_driver(drv);
>  }
>  
> --- 1.33/drivers/scsi/scsi_scan.c	Wed Nov  6 11:46:48 2002
> +++ edited/drivers/scsi/scsi_scan.c	Wed Nov  6 17:04:56 2002
> @@ -307,73 +307,6 @@
>  }
>  
>  /**
> - * scsi_device_type_read - copy out the SCSI type
> - * @driverfs_dev:	driverfs device to check
> - * @page:		copy data into this area
> - * @count:		number of bytes to copy
> - * @off:		start at this offset in page
> - *
> - * Description:
> - *     Called via driverfs when the "type" (in scsi_device_type_file)
> - *     field is read. Copy the appropriate SCSI type string into @page,
> - *     followed by a newline and a '\0'. Go through gyrations so we don't
> - *     write more than @count, and we don't write past @off.
> - *
> - * Notes:
> - *     This is for the top-most scsi entry in driverfs, the upper-level
> - *     drivers have their own type file. XXX This is not part of scanning,
> - *     other than we reference the attr struct in this file, move to
> - *     scsi.c or scsi_lib.c.
> - *
> - * Return:
> - *     number of bytes written into page.
> - **/
> -static ssize_t scsi_device_type_read(struct device *driverfs_dev, char *page,
> -	size_t count, loff_t off)
> -{
> -	struct scsi_device *sdev = to_scsi_device(driverfs_dev);
> -	const char *type;
> -	size_t size, len;
> -
> -	if ((sdev->type > MAX_SCSI_DEVICE_CODE) ||
> -	    (scsi_device_types[(int)sdev->type] == NULL))
> -		type = "Unknown";
> -	else
> -		type = scsi_device_types[(int)sdev->type];
> -	size = strlen(type);
> -	/*
> -	 * Check if off is past size + 1 for newline + 1 for a '\0'.
> -	 */
> -	if (off >= (size + 2))
> -		return 0;
> -	if (size > off) {
> -		len = min((size_t) (size - off), count);
> -		memcpy(page + off, type + off, len);
> -	} else
> -		len = 0;
> -	if (((len + off) == size) && (len < count))
> -		/*
> -		 * We are at the end of the string and have space, add a
> -		 * new line.
> -		 */
> -		*(page + off + len++) = '\n';
> -	if (((len + off) == (size + 1)) && (len < count))
> -		/*
> -		 * We are past the newline and have space, add a
> -		 * terminating '\0'.
> -		 */
> -		*(page + off + len++) = '\0';
> -	return len;
> -}
> -
> -/*
> - * Create dev_attr_type. This is different from the dev_attr_type in scsi
> - * upper level drivers.
> - */
> -static DEVICE_ATTR(type,S_IRUGO,scsi_device_type_read,NULL);
> -
> -
> -/**
>   * print_inquiry - printk the inquiry information
>   * @inq_result:	printk this SCSI INQUIRY
>   *
> @@ -1439,11 +1372,6 @@
>  	sdev->sdev_driverfs_dev.parent = &sdev->host->host_driverfs_dev;
>  	sdev->sdev_driverfs_dev.bus = &scsi_driverfs_bus_type;
>  	device_register(&sdev->sdev_driverfs_dev);
> -
> -	/*
> -	 * Create driverfs file entries
> -	 */
> -	device_create_file(&sdev->sdev_driverfs_dev, &dev_attr_type);
>  
>  	sprintf(devname, "host%d/bus%d/target%d/lun%d",
>  		sdev->host->host_no, sdev->channel, sdev->id, sdev->lun);
> 


-- 
Badari Pulavarty
pbadari@us.ibm.com
IBM Linux Technology Center - Kernel Team