linux/drivers
Nathan Lynch c92715b3c2 [SCSI] fix slab corruption during ipr probe
With CONFIG_DEBUG_SLAB=y I see slab corruption messages during boot on
pSeries machines with IPR adapters with any 2.6.12-rc kernel.

The change which seems to have introduced the problem is "SCSI: revamp
target scanning routines" and may be found at:
http://marc.theaimsgroup.com/?l=bk-commits-head&m=111093946426333&w=2

In order to revert that in a 2.6.12-rc1 tree, I had to revert "target
code updates to support scanned targets" first:
http://marc.theaimsgroup.com/?l=bk-commits-head&m=111094132524649&w=2

With both patches reverted, the corruption messages go away.

ipr: IBM Power RAID SCSI Device Driver version: 2.0.13 (February 21,
2005)
ipr 0001:d0:01.0: Found IOA with IRQ: 167
ipr 0001:d0:01.0: Starting IOA initialization sequence.
ipr 0001:d0:01.0: Adapter firmware version: 020A005C
ipr 0001:d0:01.0: IOA initialized.
scsi0 : IBM 570B Storage Adapter
  Vendor: IBM       Model: VSBPD4E1  U4SCSI  Rev: 4770
  Type:   Enclosure                          ANSI SCSI revision: 02
  Vendor: IBM   H0  Model: HUS103036FL3800   Rev: RPQF
  Type:   Direct-Access                      ANSI SCSI revision: 04
  Vendor: IBM   H0  Model: HUS103036FL3800   Rev: RPQF
  Type:   Direct-Access                      ANSI SCSI revision: 04
  Vendor: IBM   H0  Model: HUS103036FL3800   Rev: RPQF
  Type:   Direct-Access                      ANSI SCSI revision: 04
  Vendor: IBM   H0  Model: HUS103036FL3800   Rev: RPQF
  Type:   Direct-Access                      ANSI SCSI revision: 04
  Vendor: IBM       Model: VSBPD4E1  U4SCSI  Rev: 4770
  Type:   Enclosure                          ANSI SCSI revision: 02
Slab corruption: start=c0000001e8de5268, len=512
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<c00000000029c3a0>](.scsi_target_dev_release+0x28/0x50)
080: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6a
Prev obj: start=c0000001e8de5050, len=512
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<0000000000000000>](0x0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Next obj: start=c0000001e8de5480, len=512
Redzone: 0x170fc2a5/0x170fc2a5.
Last user: [<c000000000228d7c>](.as_init_queue+0x5c/0x228)
000: c0 00 00 01 e8 83 26 08 00 00 00 00 00 00 00 00
010: 00 00 00 00 00 00 00 00 c0 00 00 01 e8 de 54 98
Slab corruption: start=c0000001e8de5268, len=512
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<c00000000029c3a0>](.scsi_target_dev_release+0x28/0x50)
080: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6a
Prev obj: start=c0000001e8de5050, len=512
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<0000000000000000>](0x0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Next obj: start=c0000001e8de5480, len=512
Redzone: 0x170fc2a5/0x170fc2a5.
Last user: [<c000000000228d7c>](.as_init_queue+0x5c/0x228)
000: c0 00 00 01 e8 83 26 08 00 00 00 00 00 00 00 00
010: 00 00 00 00 00 00 00 00 c0 00 00 01 e8 de 54 98
...

I did some digging and the problem seems to be a refcounting issue in
__scsi_add_device.  The target gets freed in scsi_target_reap, and
then __scsi_add_device tries to do another device_put on it.

Signed-off-by: Nathan Lynch <ntl@pobox.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-06-03 09:38:55 -05:00
..
acorn Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
acpi [PATCH] DocBook: fix some descriptions 2005-05-01 08:59:26 -07:00
atm [ATM]: ENI155P error handling fix 2005-04-24 19:14:36 -07:00
base [PATCH] driver core: restore event order for device_add() 2005-05-23 16:08:12 -07:00
block [PATCH] packet driver permission checking fix 2005-05-20 15:48:16 -07:00
bluetooth Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cdrom [PATCH] make some things static 2005-05-05 16:36:47 -07:00
char [PATCH] ipmi build fix 2005-05-25 15:31:27 -07:00
cpufreq [PATCH] cpufreq annoying warning fix 2005-05-02 08:15:22 -07:00
crypto Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
dio Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
eisa Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
fc4 Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
firmware Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
i2c [PATCH] ppc64: Fix booting on latest G5 models 2005-05-22 17:34:42 -07:00
ide [PATCH] timeout at boottime with NEC3500A (and possibly others) when inserted a CD in it 2005-05-26 15:47:35 +02:00
ieee1394 [PATCH] ieee1394: fix premature expiry of async packets 2005-05-17 07:59:24 -07:00
infiniband [PATCH] IB: fix endianness of path record MTU field 2005-05-25 15:31:28 -07:00
input [PATCH] drivers/input/keyboard/atkbd.c: fix off by one errors 2005-05-17 07:59:17 -07:00
isdn [PATCH] make lots of things static 2005-05-01 08:59:29 -07:00
macintosh [PATCH] therm_adt746x: show correct sensor locations 2005-05-25 15:31:29 -07:00
mca Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
md [PATCH] md: set the unplug_fn and issue_flush_fn for md devices *after* committed to creation 2005-05-17 07:59:12 -07:00
media [PATCH] v4l: bttv i2c oops fix 2005-05-25 15:31:27 -07:00
message [PATCH] Convert i2o to compat_ioctl 2005-04-18 12:34:15 -05:00
misc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
mmc [PATCH] MMC: Proper MMC command classes support 2005-05-21 10:27:02 +01:00
mtd [PATCH] fix u32 vs. pm_message_t in drivers/mmc,mtd,scsi 2005-04-16 15:25:29 -07:00
net Automatic merge of /spare/repo/netdev-2.6 branch amd8111 2005-05-25 13:57:36 -04:00
nubus Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
oprofile [PATCH] oprofile trivial user annotations 2005-04-26 07:43:42 -07:00
parisc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
parport [PATCH] ISA_DMA Kconfig fixes - part 2 (parport_pc) 2005-05-04 07:33:13 -07:00
pci [PATCH] PCI: add MODALIAS to hotplug event for pci devices 2005-05-17 14:31:12 -07:00
pcmcia [PATCH] pcmcia/ds: handle any error code 2005-05-17 07:59:21 -07:00
pnp [PATCH] drivers/pnp/pnpacpi/rsparser.c: fix an array overflow 2005-05-01 08:59:30 -07:00
s390 [PATCH] s390: dasd set online failure 2005-05-17 07:59:17 -07:00
sbus [SPARC]: Eliminate local MIN/MAX macros in drivers/sbus/char/aurora.c 2005-05-15 16:01:50 -07:00
scsi [SCSI] fix slab corruption during ipr probe 2005-06-03 09:38:55 -05:00
serial When we detect that a 16550 was in fact part of a NatSemi SuperIO chip 2005-05-21 15:52:23 +01:00
sh Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sn Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
tc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
telephony [PATCH] ixj* - compile warning cleanup 2005-05-05 16:36:48 -07:00
usb [PATCH] Speedtouch resync after lost signal. 2005-05-25 10:13:43 -07:00
video [PATCH] make some things static 2005-05-05 16:36:47 -07:00
w1 [PATCH] w1_smem: w1 ID is only 8 bytes long. 2005-04-18 21:16:57 -07:00
zorro Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Kconfig Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00