Messages in this thread Patch in this message | | | Date | Sun, 23 Dec 2007 01:41:03 +0900 | Subject | Re: list corruption on ib_srp load in v2.6.24-rc5 | From | FUJITA Tomonori <> |
| |
On Fri, 21 Dec 2007 17:18:52 -0500 David Dillow <dave@thedillows.org> wrote:
> > On Fri, 2007-12-21 at 16:52 -0500, David Dillow wrote: > > I'm getting the following oops when doing the following commands: > > > > modprobe ib_srp > > <add targets(s) to ib_srp using sysfs> > > rmmod ib_srp > > modprobe ib_srp > > <OOPS> > > > > I'm going to try and track down how the list is getting corrupted; it > > looks like attribute_container_list in > > drivers/base/attribute_container.c is the one getting corrupted. > > Ok, found the culprit, now to figure out the motive and fix it. > > ib_srp's srp_cleanup_module calls srp_release_transport(), which calls > transport_container_unregister() for the rport_attr_cont member of > struct srp_internal. > > That last unregister call is returning -EBUSY, but it gets ignored, and > the list node gets erased (or just reused) when the module's text/memory > is free'd.
transport_container_unregister(&i->rport_attr_cont) should not fail here.
It fails because there is still a srp rport.
I think that as Pete pointed out, srp_remove_one needs to call srp_remove_host.
Can you try this?
Thanks,
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 950228f..bdb6f85 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2053,6 +2053,7 @@ static void srp_remove_one(struct ib_device *device) list_for_each_entry_safe(target, tmp_target, &host->target_list, list) { + srp_remove_host(target->scsi_host); scsi_remove_host(target->scsi_host); srp_disconnect_target(target); ib_destroy_cm_id(target->cm_id);
| |