sym53c8xx_2 oops in lk 2.5.69-bk14

This oops in the sym53c8xx may have been recently introduced since I run rescan-scsi-bus.sh reasonably often. It locked my system solid, scrolled the useful part of the oops off the screen and put nothing in the log. Handwritten notes:

....
scanning for device 1 0 0 0 ...
NEW: --------------[cut here]-----------
BUG at include/asm/spinlock.h:120
...
EIP is at sym53c8xx_timer+0xaa/0xc0
...

Call trace:
    sym53c8xx_timer
    sym53c8xx_timer
    run_timer_softirq
    scheduler_tick
    do_softirq

...
kernel panic: Fatal exception in interrupt

The kernel is built for SMP and running on a UP box with all kernel debug options selected. The LLD is stable otherwise.

Doug Gilbert

The scsi_host_hn_get is not doing a scsi_host_get, so any scsi_host_put that follows can break things - for example causing the scsi_host to disappear out from under us. See the scsi_proc.c usage.

Christoph's "give ->proc_info a struct Scsi_Host * parameter" patch got rid of a lot of them (and is in scsi-miscs-2.5), but not in scsi_proc.c.

Looks like scsi_host_hn_get should always call scsi_host_get, but scsi_find_host_by_num really has to change to use driver model iterators (so its locking protection matches scsi_host_get), I assume this is a WIP for Christoph or Mike but for now you could use a patch like this (untested, on top of scsi-misc-2.5 or Christoph's changes):

===== drivers/scsi/hosts.c 1.65 vs edited =====

@@ -534,8 +534,12 @@
  **/
 struct Scsi_Host *scsi_host_hn_get(unsigned short host_no)
 {
-	/* XXX Inc ref count */
-	return scsi_find_host_by_num(host_no);
+	struct Scsi_Host *shost;
+
+	shost = scsi_find_host_by_num(host_no);
+	if (shost)
+		scsi_host_get(shost);
+	return shost;
 }
 
 /**

-- Patrick Mansfield

Patrick,
Thanks, that patch fixed the problem I reported.

Doug Gilbert