[openib-general] oops at device removal

[Michael S. Tsirkin]

We have observed the following crash:

Unable to handle kernel paging request at 0000000000100108 RIP:
<ffffffff8823af5f>{:ib_core:ib_unregister_event_handler+31}
PGD 117034067 PUD 102047067 PMD 0
Oops: 0002 [1] SMP
last sysfs file: /devices/pci0000:00/0000:00:06.0/0000:08:00.0/subsystem_device
CPU 2
Modules linked in: autofs4 ipv6 raw ib_sa ib_uverbs ib_umad nfs lockd nfs_acl sunrpc ib_mt
hca ib_mad ib_core memtrack af_packet button battery ac apparmor aamatch_pcre loop dm_mod
ehci_hcd uhci_hcd ide_cd cdrom i8xx_tco usbcore shpchp e1000 pci_hotplug floppy ext3 jbd e
dd fan thermal processor sg mptspi mptscsih mptbase scsi_transport_spi piix sd_mod scsi_mo
d ide_disk ide_core
Pid: 9241, comm: modprobe Tainted: G     U 2.6.16.21-0.8-smp #1
RIP: 0010:[<ffffffff8823af5f>] <ffffffff8823af5f>{:ib_core:ib_unregister_event_handler+31}
RSP: 0000:ffff810100801e68  EFLAGS: 00010046
RAX: 0000000000200200 RBX: ffffffff883282e0 RCX: ffffffff883282f0
RDX: 0000000000100100 RSI: 0000000000000282 RDI: ffff810119836058
RBP: ffff8101119ce480 R08: ffff8101119ce608 R09: ffff810100801e40
R10: 0000000000000001 R11: ffff81010f493e38 R12: 0000000000000000
R13: ffffffff88324020 R14: ffff810119af9080 R15: 0000000000000292
FS:  00002b7fa92af6d0(0000) GS:ffff81011c06b340(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000100108 CR3: 0000000101a04000 CR4: 00000000000006e0
Process modprobe (pid: 9241, threadinfo ffff810100800000, task ffff81011b1b0080)
Stack: ffff8101119ce490 ffffffff8831f036 ffff810119af9070 ffff810119836000
       ffff810111ab2de0 ffffffff8823b615 ffff810110005820 ffffffff8033da60
       ffffffff88324080 0000000000000080
Call Trace: <ffffffff8831f036>{:ib_sa:mcast_remove_one+43}
       <ffffffff8823b615>{:ib_core:ib_unregister_client+55}
       <ffffffff8831efc8>{:ib_sa:mcast_cleanup+16} <ffffffff8832001d>{:ib_sa:ib_sa_cleanup
+9}
       <ffffffff8014aa3c>{sys_delete_module+540} <ffffffff80167e37>{do_munmap+619}
       <ffffffff801e7e6b>{__up_write+33} <ffffffff8010a7be>{system_call+126}

Code: 48 89 42 08 48 89 10 48 c7 41 08 00 02 20 00 48 8b 3b 48 c7
RIP <ffffffff8823af5f>{:ib_core:ib_unregister_event_handler+31} RSP <ffff810100801e68>
CR2: 0000000000100108

Address ib_unregister_event_handler+31 is here:

/tmp/openib_gen2/last_stable/gen2_devel_kernel/drivers/infiniband/core/device.c:450
list_del():
	/usr/src/linux-2.6.16.21-0.8/include/linux/list.h:165
	__list_del():
	/usr/src/linux-2.6.16.21-0.8/include/linux/list.h:153
		    1cdb:       48 89 42 08             mov    %rax,0x8(%rdx)



-- 
MST