[openib-general] crash in ib_sa_mcmember_rec_callback while probing out ib_sa

[Or Gerlitz]

By mistake i was trying to bringup ib1 where port 1 and not 2 was the
active port, and then got this crash on the rmmod script which is doing:

ifconfig ib0 down
ifconfig ib1 down
modprobe -r ib_ipoib
modprobe -r ib_mthca

this is the dmesg crash - it happened over x86 with svn 7772

Or.

ADDRCONF(NETDEV_UP): ib1: link is not ready
Unable to handle kernel paging request at virtual address f8dd6758
 printing eip:
f8dd6758
*pde = 37c99067
*pte = 00000000
Oops: 0000 [#1]
SMP
Modules linked in: parport_pc lp parport autofs4 nfs lockd sunrpc button battery ac ipv6 ohci_hcd i2c_amd8111 i2c_core hw_random shpchp ib_mthca ib_sa ib_mad ib_core e100 mii tg3 floppy dm_snapshot dm_zero dm_mirror dm_mod sata_sil libata sd_mod scsi_mod
CPU:    1
EIP:    0060:[<f8dd6758>]    Not tainted VLI
EFLAGS: 00210246   (2.6.16 #1)
EIP is at 0xf8dd6758
eax: 00000000   ebx: ef2a2594   ecx: ef2a25a0   edx: f599beec
esi: f38a5bec   edi: f38a5bf4   ebp: fffffffc   esp: f599be60
ds: 007b   es: 007b   ss: 0068
Process modprobe (pid: 20746, threadinfo=f599a000 task=f6411aa0)
Stack: <0>f8dd1721 fffffffc 00000000 ecd95798 f66f9000 00000000 00000000 f599beb8
       00000000 00000022 00000001 0000000f 00200286 f7878ec8 c03217dc c0150cfa
       f7fff200 6b00002c f4c9d668 f7fff200 ef2a2594 f38a5bf4 f599bef4 f599beec
Call Trace:
 [<f8dd1721>] ib_sa_mcmember_rec_callback+0x43/0x4e [ib_sa]
 [<c03217dc>] _spin_unlock_irqrestore+0x9/0xe
 [<c0150cfa>] poison_obj+0x21/0x41
 [<f8dd18b7>] send_handler+0x39/0x88 [ib_sa]
 [<f8db8a16>] cancel_mads+0x111/0x12f [ib_mad]
 [<f8db6787>] unregister_mad_agent+0xe/0xae [ib_mad]
 [<f8db688f>] ib_unregister_mad_agent+0x13/0x1f [ib_mad]
 [<f8dd1b4a>] ib_sa_remove_one+0x3c/0x6e [ib_sa]
 [<f8dab111>] ib_unregister_client+0x34/0xb0 [ib_core]
 [<f8dd1b86>] ib_sa_cleanup+0xa/0x17 [ib_sa]
 [<c01323df>] sys_delete_module+0x129/0x162
 [<c0148103>] do_munmap+0xe7/0xf3
 [<c014815c>] sys_munmap+0x4d/0x69
 [<c01026b7>] sysenter_past_esp+0x54/0x75
Code:  Bad EIP value.
 BUG: modprobe/20746, lock held at task exit time!
 [f8db4280] {device_mutex}
.. held by:          modprobe:20746 [f6411aa0, 118]
... acquired at:               ib_unregister_client+0x12/0xb0 [ib_core]