[BUG] Kernel panic in libfc code

Kernel panic in libfc code

Issue:

System panic. Crash message seen on the console or in vmcore log command looks like:

Unable to handle kernel paging request at 0000000000200200 RIP:
 [<>] list_del+0x8/0x71
RIP: 0010:[]  [] list_del+0x8/0x71
RSP: 0018:ffff81186bf61db0  EFLAGS: 00010297
RAX: 0000000000200200 RBX: ffff810c674f9ed0 RCX: 0000000000000000
RDX: ffff810c68408550 RSI: 0000000000000282 RDI: ffff810c674f9ed0
RBP: ffff810c674f9e00 R08: ffff810c675c8210 R09: 0000000000000028
R10: ffffffff804b1300 R11: ffff810c68408550 R12: 0000000000000000
R13: ffff810c674f9e48 R14: ffff810c684084f8 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff810c9a3ebcc0(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000200200 CR3: 0000000ae4890000 CR4: 00000000000006e0
Process fc_rport_eq (pid: 3262, threadinfo ffff81186bf60000,
task ffff810c680ef080)
Stack:  ffff810c68408550 ffffffff88205d43 0000000300000000 00853840675c8208
 0000000000000000 0000000100000001 0000000000000086 0000000000000003
 ffff81186bf61e30 ffffffff8002e261 0000000010000042 ffff810c674f9ee0
Call Trace:
 [<>] :libfc:fc_rport_work+0x237/0x36b
 [<>] __wake_up+0x38/0x4f
 [<>] :libfc:fc_rport_work+0x0/0x36b
 [<>] run_workqueue+0x99/0xf6
 [<>] worker_thread+0x0/0x122
 [<>] keventd_create_kthread+0x0/0xc4
 [<>] worker_thread+0xf0/0x122
 [<>] default_wake_function+0x0/0xe
 [<>] keventd_create_kthread+0x0/0xc4
 [<>] kthread+0xfe/0x132
 [<>] child_rip+0xa/0x11
 [<>] keventd_create_kthread+0x0/0xc4
 [<>] kthread+0x0/0x132
 [<>] child_rip+0x0/0x11


Code: 48 8b 10 48 39 fa 74 1b 48 89 fe 31 c0 48 c7 c7 90 3b 2c 80
RIP  [] list_del+0x8/0x71
 RSP 
    

Environment:

• Red Hat Enterprise Linux 5
• 2.6.18-238.el5

Resolution:

• Fixed in RHEL5.9.z Errata kernel 2.6.18-348.1.1.el5
• Fixed in RHEL5.6.z Errata kernel 2.6.18-238.48.1.el5

This update simplifies the remote port (rport) restart logic by making the decision to restart after deleting the transport rport. Now, all I/O operations run as expected and fc_rport_work() no longer crashes in the described scenario.

Root Cause:

If a target sent multiple local port logout (LOGO) events, the fc_rport_work() function in the Fibre Channel library module (libfc) tried to process all of them, irrespective of the status of processing prior to the LOGO events. Consequently, fc_rport_work() terminated unexpectedly with a stack trace.