Bug 3962

Summary: Kernel NULL pointer dereference on unloading ide-scsi
Product: IO/Storage Reporter: Michael Eyrich (eyrich)
Component: IDEAssignee: Bartlomiej Zolnierkiewicz (bzolnier)
Status: REJECTED DUPLICATE    
Severity: high    
Priority: P2    
Hardware: i386   
OS: Linux   
Kernel Version: 2.6.10 Subsystem:
Regression: --- Bisected commit-id:

Description Michael Eyrich 2004-12-29 05:52:02 UTC 
Distribution: 
Debian testing/unstable 
 
Hardware Environment: 
HP omnibook 6000 PIII/1GH 
Toshiba DVD+/-RW 
Vendor: TOSHIBA   Model: ODD-DVD SD-R6372  Rev: 1032 
 
 
Software Environment: 
Reading specs from /usr/lib/gcc-lib/i486-linux/3.3.4/specs 
Configured with: ../src/configure -v 
--enable-languages=c,c++,java,f77,pascal,objc,ada,treelang --prefix=/usr 
--mandir=/usr/share/man --infodir=/usr/share/info 
--with-gxx-include-dir=/usr/include/c++/3.3 --enable-shared --with-system-zlib 
--enable-nls --without-included-gettext --enable-__cxa_atexit 
--enable-clocale=gnu --enable-debug --enable-java-gc=boehm 
--enable-java-awt=xlib --enable-objc-gc i486-linux 
Thread model: posix 
gcc version 3.3.4 (Debian 1:3.3.4-13) 
 
Problem Description: 
 
modprobe -r ide-scsi 
 
--> unable to handle kernel NUlL pointer dereference 
 kernel: Unable to handle kernel NULL pointer dereference at virtual address 
0000023c 
 kernel:  printing eip: 
 kernel: e08ad5bd 
 kernel: *pde = 00000000 
 kernel: Oops: 0000 [#1] 
 kernel: PREEMPT  
 kernel: Modules linked in: ipt_TOS ipt_MASQUERADE vmnet vmmon ip6table_filter 
ip6_tables nfs hostap_cs hostap nfsd exportfs lockd sunrpc lp autofs4 
ipt_REJECT ipt_pkttype ipt_LOG ipt_TCPMSS ipt_state ipt_multiport 
ipt_conntrack iptable_mangle ip_nat_irc ip_nat_tftp ip_nat_ftp iptable_nat 
ip_conntrack_irc ip_conntrack_tftp ip_conntrack_ftp ip_conntrack 
iptable_filter ip_tables dummy irtty_sir sir_dev irda crc_ccitt 8250_pnp 8250 
serial_core joydev tsdev parport_pc parport uhci_hcd usbcore yenta_socket 
3c59x snd_maestro3 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer 
snd_page_alloc snd soundcore ide_scsi evdev 
 kernel: CPU:    0 
 kernel: EIP:    0060:[pg0+540140989/1067906048]    Tainted: P      VLI 
 kernel: EFLAGS: 00010016   (2.6.10-sws-min)  
 kernel: EIP is at idescsi_queue+0x10d/0x400 [ide_scsi] 
 kernel: eax: 00000000   ebx: de6d6f20   ecx: ddd18040   edx: c057e574 
 kernel: esi: 00001388   edi: c02d54f0   ebp: c5aabc60   esp: c5aabc28 
 kernel: ds: 007b   es: 007b   ss: 0068 
 kernel: Process modprobe (pid: 22627, threadinfo=c5aaa000 task=cee17ae0) 
 kernel: Stack: dffef460 00000020 c8085889 de6d6f20 ddd180a8 c5aabc60 00000246 
ddd18094  
 kernel:        cbf910a0 00000230 c057e574 ddd18040 00000293 ddd18040 c5aabc8c 
c02d5259  
 kernel:        ddd18040 c02d54f0 c02d7e00 00000000 de555000 ddd18094 ddd18040 
ddc29400  
 kernel: Call Trace: 
 kernel:  [show_stack+127/160] show_stack+0x7f/0xa0 
 kernel:  [show_registers+342/448] show_registers+0x156/0x1c0 
 kernel:  [die+234/384] die+0xea/0x180 
 kernel:  [do_page_fault+672/1702] do_page_fault+0x2a0/0x6a6 
 kernel:  [error_code+43/48] error_code+0x2b/0x30 
 kernel:  [scsi_dispatch_cmd+425/704] scsi_dispatch_cmd+0x1a9/0x2c0 
 kernel:  [scsi_request_fn+530/1088] scsi_request_fn+0x212/0x440 
 kernel:  [blk_insert_request+186/224] blk_insert_request+0xba/0xe0 
 kernel:  [scsi_insert_special_req+57/64] scsi_insert_special_req+0x39/0x40 
 kernel:  [scsi_wait_req+98/160] scsi_wait_req+0x62/0xa0 
 kernel:  [sr_do_ioctl+144/656] sr_do_ioctl+0x90/0x290 
 kernel:  [sr_packet+37/64] sr_packet+0x25/0x40 
 kernel:  [cdrom_get_disc_info+94/176] cdrom_get_disc_info+0x5e/0xb0 
 kernel:  [cdrom_mrw_exit+27/112] cdrom_mrw_exit+0x1b/0x70 
 kernel:  [unregister_cdrom+165/240] unregister_cdrom+0xa5/0xf0 
 kernel:  [sr_kref_release+65/112] sr_kref_release+0x41/0x70 
 kernel:  [kref_put+54/160] kref_put+0x36/0xa0 
 kernel:  [sr_remove+58/80] sr_remove+0x3a/0x50 
 kernel:  [device_release_driver+124/128] device_release_driver+0x7c/0x80 
 kernel:  [bus_remove_device+98/160] bus_remove_device+0x62/0xa0 
 kernel:  [device_del+93/160] device_del+0x5d/0xa0 
 kernel:  [scsi_remove_device+88/176] scsi_remove_device+0x58/0xb0 
 kernel:  [scsi_forget_host+68/144] scsi_forget_host+0x44/0x90 
 kernel:  [scsi_remove_host+20/112] scsi_remove_host+0x14/0x70 
 kernel:  [pg0+540140396/1067906048] idescsi_cleanup+0x4c/0x60 [ide_scsi] 
 kernel:  [ide_unregister_driver+124/181] ide_unregister_driver+0x7c/0xb5 
 kernel:  [pg0+540143330/1067906048] exit_idescsi_module+0x12/0x16 [ide_scsi] 
 kernel:  [sys_delete_module+357/416] sys_delete_module+0x165/0x1a0 
 kernel:  [syscall_call+7/11] syscall_call+0x7/0xb 
 kernel: Code: 00 00 00 8b 4d 08 8b 41 64 89 4b 2c 89 43 14 89 43 0c 8b 7d 0c 
89 7b 30 a1 20 4d 48 c0 8b 71 3c 01 f0 89 43 38 8b 55 f0 8b 42 20 <8b> 80 3c 
02 00 00 a8 01 74 05 0f ba 6b 34 02 8b 4b 1c 89 4d e0  
 kernel:  <6>note: modprobe[22627] exited with preempt_count 1 
 kernel: scheduling while atomic: modprobe/0x00000001/22627 
 kernel:  [dump_stack+30/48] dump_stack+0x1e/0x30 
 kernel:  [schedule+1330/1344] schedule+0x532/0x540 
 kernel:  [generic_file_buffered_write+997/1552] 
generic_file_buffered_write+0x3e5/0x610 
 kernel:  [__generic_file_aio_write_nolock+598/1152] 
__generic_file_aio_write_nolock+0x256/0x480 
 kernel:  [generic_file_aio_write_nolock+66/160] 
generic_file_aio_write_nolock+0x42/0xa0 
 kernel:  [generic_file_aio_write+113/240] generic_file_aio_write+0x71/0xf0 
 kernel:  [ext3_file_write+63/208] ext3_file_write+0x3f/0xd0 
 kernel:  [do_sync_write+163/208] do_sync_write+0xa3/0xd0 
 kernel:  [do_acct_process+959/992] do_acct_process+0x3bf/0x3e0 
 kernel:  [acct_process+70/136] acct_process+0x46/0x88 
 kernel:  [do_exit+1036/1152] do_exit+0x40c/0x480 
 kernel:  [die+379/384] die+0x17b/0x180 
 kernel:  [do_page_fault+672/1702] do_page_fault+0x2a0/0x6a6 
 kernel:  [error_code+43/48] error_code+0x2b/0x30 
 kernel:  [scsi_dispatch_cmd+425/704] scsi_dispatch_cmd+0x1a9/0x2c0 
 kernel:  [scsi_request_fn+530/1088] scsi_request_fn+0x212/0x440 
 kernel:  [blk_insert_request+186/224] blk_insert_request+0xba/0xe0 
 kernel:  [scsi_insert_special_req+57/64] scsi_insert_special_req+0x39/0x40 
 kernel:  [scsi_wait_req+98/160] scsi_wait_req+0x62/0xa0 
 kernel:  [sr_do_ioctl+144/656] sr_do_ioctl+0x90/0x290 
 kernel:  [sr_packet+37/64] sr_packet+0x25/0x40 
 kernel:  [cdrom_get_disc_info+94/176] cdrom_get_disc_info+0x5e/0xb0 
 kernel:  [cdrom_mrw_exit+27/112] cdrom_mrw_exit+0x1b/0x70 
 kernel:  [unregister_cdrom+165/240] unregister_cdrom+0xa5/0xf0 
 kernel:  [sr_kref_release+65/112] sr_kref_release+0x41/0x70 
 kernel:  [kref_put+54/160] kref_put+0x36/0xa0 
 kernel:  [sr_remove+58/80] sr_remove+0x3a/0x50 
 kernel:  [device_release_driver+124/128] device_release_driver+0x7c/0x80 
 kernel:  [bus_remove_device+98/160] bus_remove_device+0x62/0xa0 
 kernel:  [device_del+93/160] device_del+0x5d/0xa0 
 kernel:  [scsi_remove_device+88/176] scsi_remove_device+0x58/0xb0 
 kernel:  [scsi_forget_host+68/144] scsi_forget_host+0x44/0x90 
 kernel:  [scsi_remove_host+20/112] scsi_remove_host+0x14/0x70 
 kernel:  [pg0+540140396/1067906048] idescsi_cleanup+0x4c/0x60 [ide_scsi] 
 kernel:  [ide_unregister_driver+124/181] ide_unregister_driver+0x7c/0xb5 
 kernel:  [pg0+540143330/1067906048] exit_idescsi_module+0x12/0x16 [ide_scsi] 
 kernel:  [sys_delete_module+357/416] sys_delete_module+0x165/0x1a0 
 kernel:  [syscall_call+7/11] syscall_call+0x7/0xb 
 kernel: Unable to handle kernel NULL pointer dereference at virtual address 
0000023c 
 kernel:  printing eip: 
 kernel: e08ad5bd 
 kernel: *pde = 00000000 
 kernel: Oops: 0000 [#2] 
 kernel: PREEMPT  
 kernel: Modules linked in: ipt_TOS ipt_MASQUERADE vmnet vmmon ip6table_filter 
ip6_tables nfs hostap_cs hostap nfsd exportfs lockd sunrpc lp autofs4 
ipt_REJECT ipt_pkttype ipt_LOG ipt_TCPMSS ipt_state ipt_multiport 
ipt_conntrack iptable_mangle ip_nat_irc ip_nat_tftp ip_nat_ftp iptable_nat 
ip_conntrack_irc ip_conntrack_tftp ip_conntrack_ftp ip_conntrack 
iptable_filter ip_tables dummy irtty_sir sir_dev irda crc_ccitt 8250_pnp 8250 
serial_core joydev tsdev parport_pc parport uhci_hcd usbcore yenta_socket 
3c59x snd_maestro3 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer 
snd_page_alloc snd soundcore ide_scsi evdev 
 kernel: CPU:    0 
 kernel: EIP:    0060:[pg0+540140989/1067906048]    Tainted: P      VLI 
 kernel: EFLAGS: 00010006   (2.6.10-sws-min)  
 kernel: EIP is at idescsi_queue+0x10d/0x400 [ide_scsi] 
 kernel: eax: 00000000   ebx: cd5a7f60   ecx: ddd18040   edx: c057e574 
 kernel: esi: 00001388   edi: c02d8110   ebp: ddd91ee8   esp: ddd91eb0 
 kernel: ds: 007b   es: 007b   ss: 0068 
 kernel: Process scsi_eh_0 (pid: 2280, threadinfo=ddd90000 task=decb40c0) 
 kernel: Stack: dffef460 00000020 ddd180a8 cd5a7f60 ddd180a8 ddd91ee8 00000246 
ddd18094  
 kernel:        cbf912e0 00000230 c057e574 00000282 ddd90000 ddd18040 ddd91f24 
c02d823e  
 kernel:        ddd18040 c02d8110 c02d80b0 c02c007b 00002002 de555000 00000000 
00000000  
 kernel: Call Trace: 
 kernel:  [show_stack+127/160] show_stack+0x7f/0xa0 
 kernel:  [show_registers+342/448] show_registers+0x156/0x1c0 
 kernel:  [die+234/384] die+0xea/0x180 
 kernel:  [do_page_fault+672/1702] do_page_fault+0x2a0/0x6a6 
 kernel:  [error_code+43/48] error_code+0x2b/0x30 
 kernel:  [scsi_send_eh_cmnd+174/512] scsi_send_eh_cmnd+0xae/0x200 
 kernel:  [scsi_eh_tur+148/256] scsi_eh_tur+0x94/0x100 
 kernel:  [scsi_eh_abort_cmds+168/240] scsi_eh_abort_cmds+0xa8/0xf0 
 kernel:  [scsi_unjam_host+179/528] scsi_unjam_host+0xb3/0x210 
 kernel:  [scsi_error_handler+206/368] scsi_error_handler+0xce/0x170 
 kernel:  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10 
 kernel: Code: 00 00 00 8b 4d 08 8b 41 64 89 4b 2c 89 43 14 89 43 0c 8b 7d 0c 
89 7b 30 a1 20 4d 48 c0 8b 71 3c 01 f0 89 43 38 8b 55 f0 8b 42 20 <8b> 80 3c 
02 00 00 a8 01 74 05 0f ba 6b 34 02 8b 4b 1c 89 4d e0  
 kernel:  <6>note: scsi_eh_0[2280] exited with preempt_count 1 
 
 
 
 
Steps to reproduce:
Comment 1 Bartlomiej Zolnierkiewicz 2005-02-08 15:28:05 UTC 
this is the same bug, I'm working on it

*** This bug has been marked as a duplicate of 3568 ***