(unknown)

I have a bug to report. I previously wrote (on linux-usb-devel) about problems with http://bugme.osdl.org/show_bug.cgi?id=3728, which has now been fixed. However, the world is not trouble-free yet, as linux still crashes in certain situations on 2.6.10-rc2 with SMP systems. (UP systems are fine).

The new bug is http://bugme.osdl.org/show_bug.cgi?id=3761, which I marked as "blocking" because it's very easy to bring the whole system down.

Could someone smart please take a look at the dmesg I attached to the bug post? Particularly, what the foo is going on here: ?

usb 4-2: USB disconnect, address 2
usb 4-2.3: USB disconnect, address 5
 target5:0:0: Illegal state transition <NULL>->cancel Badness in scsi_device_set_state at drivers/scsi/scsi_lib.c:1717

 [<b0324d16>] scsi_device_set_state+0xc6/0x130
 [<b031fcaa>] scsi_device_cancel+0x2a/0x106
 [<b031fe10>] scsi_device_cancel_cb+0x0/0x20
 [<b02f128e>] device_for_each_child+0x3e/0x70
 [<b031fe61>] scsi_host_cancel+0x31/0xc0
 [<b031fe10>] scsi_device_cancel_cb+0x0/0x20
 [<b026765e>] kobject_put+0x1e/0x30
 [<b026765e>] kobject_put+0x1e/0x30
 [<b0267630>] kobject_release+0x0/0x10
 [<b032726d>] scsi_remove_device+0x7d/0xb0
 [<b032641d>] scsi_forget_host+0x3d/0x60
 [<b031ff13>] scsi_remove_host+0x23/0x80
 [<b0378aa6>] storage_disconnect+0x86/0x9e
 [<b035cdb8>] usb_unbind_interface+0x88/0x90
 [<b02f21ef>] device_release_driver+0x7f/0x90
 [<b02f2435>] bus_remove_device+0x65/0xb0
 [<b02f11cf>] device_del+0x5f/0xb0
 [<b0364006>] usb_disable_device+0xb6/0x100
 [<b035f25f>] usb_disconnect+0x9f/0x150
 [<b035f2db>] usb_disconnect+0x11b/0x150
 [<b036053a>] hub_port_connect_change+0x3ba/0x3f0
 [<b035df38>] clear_port_feature+0x58/0x60
 [<b03607bc>] hub_events+0x24c/0x370
 [<b0360915>] hub_thread+0x35/0x110
 [<b01325c0>] autoremove_wake_function+0x0/0x60
 [<b01030b2>] ret_from_fork+0x6/0x14
 [<b01325c0>] autoremove_wake_function+0x0/0x60
 [<b03608e0>] hub_thread+0x0/0x110
 [<b01012d1>] kernel_thread_helper+0x5/0x14

I hope somebody can help me, and I apologize if I seem impatient. I really would like this issue to be resolved, not just for my own sake.

I'd be more than happy to help in any way I can, just say what you need, and I'll get it. More debug info? Other kinds of log? Hardware information?

Regards,
Christian Iversen
-
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Well, Oops. The I posted the patch to fix this a while ago (it was subsequently modified by Mike Christie). Apparently I put Mike's update in the BK tree, but not my own initial patch (I suppose dropping other people's patches can be considered unfortunate, but dropping your own looks like carelessness).

Anyway, the attached should fix it, if you give it a whirl.

James

# This is a BitKeeper generated diff -Nru style patch. #
# ChangeSet
# 2004/11/18 17:00:19-06:00 jejb@mulgrave.(none)
# SCSI: fix USB forced remove oops
#

#   Because of the changes to add the target in to the
#   driver model, the cancellation method no-longer works
#   correctly.

#
# Fix it by iterating using shost_for_each_device instead.
#
# Signed-off-by: James Bottomley <[email protected]>
#

# drivers/scsi/hosts.c
#   2004/11/18 16:59:11-06:00 jejb@mulgrave.(none) +5 -7
#   SCSI: fix USB forced remove oops
# 
diff -Nru a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
--- a/drivers/scsi/hosts.c	2004-11-18 17:38:59 -06:00
+++ b/drivers/scsi/hosts.c	2004-11-18 17:38:59 -06:00
@@ -50,11 +50,6 @@
 	.release	= scsi_host_cls_release,
 };

-static int scsi_device_cancel_cb(struct device *dev, void *data) -{
- return scsi_device_cancel(to_scsi_device(dev), *(int *)data);
-}
-
/**
* scsi_host_cancel - cancel outstanding IO to this host
* @shost: pointer to struct Scsi_Host
@@ -62,9 +57,12 @@
**/
void scsi_host_cancel(struct Scsi_Host *shost, int recovery) {
+ struct scsi_device *sdev;
+
set_bit(SHOST_CANCEL, &shost->shost_state);
- device_for_each_child(&shost->shost_gendev, &recovery,
- scsi_device_cancel_cb);
+ shost_for_each_device(sdev, shost) {
+ scsi_device_cancel(sdev, recovery);
+ }
wait_event(shost->host_wait, (!test_bit(SHOST_RECOVERY,
&shost->shost_state)));
}