> Apr  7 18:17:17 lab105 kernel: Unable to handle kernel paging request at 
> virtual address 6b6b6b6b6b6b6b6b

I think I fixed the bug causing this oops (I was able to reproduce it,
and I don't see it any more).  I checked the following patch in and
queued it for kernel 2.6.17:

diff-tree 44f29db23e1994bed2f3254dc6fef4185fdd0541 (from 
59fef3b1e96217c6e736372ff8cc95cbcca1b6aa)
Author: Roland Dreier <[EMAIL PROTECTED]>
Date:   Wed Apr 12 12:20:51 2006 -0700

    IB/srp: Remove request from list when SCSI abort succeeds
    
    If a SCSI abort succeeds, then the aborted request should to be
    removed from the list of pending requests.  This fixes list corruption
    after an abort occurs.
    
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c 
b/drivers/infiniband/ulp/srp/ib_srp.c
index 5f2b3f6..5bb5574 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -617,6 +617,14 @@ static void srp_unmap_data(struct scsi_c
                     scmnd->sc_data_direction);
 }
 
+static void srp_remove_req(struct srp_target_port *target, struct srp_request 
*req,
+                          int index)
+{
+       list_del(&req->list);
+       req->next = target->req_head;
+       target->req_head = index;
+}
+
 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp 
*rsp)
 {
        struct srp_request *req;
@@ -664,9 +672,7 @@ static void srp_process_rsp(struct srp_t
                        scmnd->host_scribble = (void *) -1L;
                        scmnd->scsi_done(scmnd);
 
-                       list_del(&req->list);
-                       req->next = target->req_head;
-                       target->req_head = rsp->tag & ~SRP_TAG_TSK_MGMT;
+                       srp_remove_req(target, req, rsp->tag & 
~SRP_TAG_TSK_MGMT);
                } else
                        req->cmd_done = 1;
        }
@@ -1188,12 +1194,10 @@ static int srp_send_tsk_mgmt(struct scsi
        spin_lock_irq(target->scsi_host->host_lock);
 
        if (req->cmd_done) {
-               list_del(&req->list);
-               req->next = target->req_head;
-               target->req_head = req_index;
-
+               srp_remove_req(target, req, req_index);
                scmnd->scsi_done(scmnd);
        } else if (!req->tsk_status) {
+               srp_remove_req(target, req, req_index);
                scmnd->result = DID_ABORT << 16;
                ret = SUCCESS;
        }
_______________________________________________
openib-general mailing list
[email protected]
http://openib.org/mailman/listinfo/openib-general

To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general

Reply via email to