oops when removing storage device with no actual drive

Hello.

Kernel 2.6.12.4 (or -2.6.12-1.1398_FC4)

Below is a backtrace for a 100% reproducible oops. Recipe:

1. External usb disk enclosure for an IDE drive.
2. Drive set to slave instead of master (or cable-select, probably). Jumper is set to Master, all is fine.
3. No drive found after plugging in (maybe OK)
4. OOPS happens as soon as I turn off or unplug the device.

usb-storage: device found at 26
usb-storage: waiting for device to settle before scanning
scsi: Device offlined - not ready after error recovery: host 4 channel 0 id 0 lu n 0
usb 2-7: USB disconnect, address 26
usb-storage: device scan complete

Unable to handle kernel NULL pointer dereference at virtual address 00000048
printing eip:
c0199cb3
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: usb_storage radeon ipv6 parport_pc lp parport autofs4 rfcomm

l2cap sunrpc ipt_REJECT ipt_state ip_conntrack iptable_filter ip_tables binfmt_m isc dm_mod video button battery ac ati_remote ohci1394 ieee1394 usblp joydev uhc i_hcd ehci_hcd budget l64781 ves1820 budget_core saa7146 ttpci_eeprom stv0299 td a8083 ves1x93 dvb_core tuner saa7134 video_buf v4l2_common v4l1_compat ir_common videodev pdc202xx_new shpchp i2c_viapro i2c_core snd_emu10k1_synth snd_emux_syn th snd_seq_virmidi snd_seq_midi_emul snd_emu10k1 snd_rawmidi snd_ac97_codec snd_ seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_ mixer_oss snd_pcm snd_timer snd_page_alloc snd_util_mem snd_hwdep snd soundcore sk98lin floppy ext3 jbd raid1 sata_promise sata_via libata sd_mod scsi_mod

CPU:    0
EIP:    0060:[<c0199cb3>]    Not tainted VLI
EFLAGS: 00010292   (2.6.12.4)

EIP is at sysfs_hash_and_remove+0x13/0xeb
eax: 00000000 ebx: edecc64c ecx: 00000000 edx: 00000066
esi: edecc644 edi: f885dc20 ebp: f885dbc0 esp: f7b25e34
ds: 007b es: 007b ss: 0068
Process khubd (pid: 114, threadinfo=f7b25000 task=f7b22520)

Stack: c033ca3c 00000000 c0314e16 edecc64c edecc644 f885dc20 f885dbc0 c023eeaa
      f885dc28 edecc644 edecc400 ef278c28 e4392480 c023eee8 edecc590 
f884b6a5
      ef278bf8 edecc400 ef278c00 f884b787 00000202 f7b25000 f7b25000 
ef278c04
Call Trace:
[<c0314e16>] __down+0xb6/0x140
[<c023eeaa>] class_device_del+0x8a/0xc0
[<c023eee8>] class_device_unregister+0x8/0x10
[<f884b6a5>] scsi_remove_device+0x65/0xa0 [scsi_mod]
[<f884b787>] __scsi_remove_target+0xa7/0x110 [scsi_mod]
[<f884a7a2>] scsi_forget_host+0x52/0xb0 [scsi_mod]
[<f88425d1>] scsi_remove_host+0x11/0x60 [scsi_mod]
[<f8d75b1f>] storage_disconnect+0x5f/0x79 [usb_storage]
[<c0278982>] usb_unbind_interface+0x32/0x60
[<c023dbc0>] device_release_driver+0x50/0x70
[<c023de20>] bus_remove_device+0x70/0xc0
[<c023cdf5>] device_del+0x65/0xa0
[<c028045b>] usb_disable_device+0x9b/0xf0
[<c027adac>] usb_disconnect+0x9c/0x150
[<c027be3e>] hub_port_connect_change+0x4e/0x3c0
[<c0279a88>] clear_port_feature+0x48/0x50
[<c027c436>] hub_events+0x286/0x3e0
[<c027c5df>] hub_thread+0x4f/0x110
[<c0134580>] autoremove_wake_function+0x0/0x50
[<c027c590>] hub_thread+0x0/0x110
[<c0101325>] kernel_thread_helper+0x5/0x10
Code: c4 b9 17 00 8d 74 26 00 e9 3f ff ff ff 8d 74 26 00 8d bc 27 00 00 00 00 55

57 56 53 83 ec 0c 89 44 24 04 89 14 24 ba 66 00 00 00 <8b> 70 48 8b 58 08 b8 a2 17 33 c0 e8 1d 2a f8 ff ff 4b 70 0f 88

Mark

This is suspiciously similar to the oops when trying to add new class links in the devices. Could you try the fix reported there:

http://marc.theaimsgroup.com/?l=linux-scsi&m=112398346008284

And see if it works for you?

Thanks,

James

That seems to fix it. Thanks.

Mark