2.4.17-rc2 BUG at slab.c:1110

[Paul Mackerras]

I'm seeing BUG messages when I eject a compact flash card from the
pcmcia slot on my powerbook, not every time but quite often.  The
stack trace looks like this:

c002e99c kmem_cache_grow+0x94
c002ed60 kmem_cache_alloc+0x144
c008844c devfsd_notify_de+0x60
c008852c devfsd_notify+0x30
c0088984 unregister+0x48
c0088a14 devfs_unregister+0x2c
c010c950 ide_unregister+0x200
cd9798b0 ide_release+0x2c
c001e928 timer_bh+0x2f4
c001a314 bh_action+0x3c
c001a1c4 tasklet_hi_action+0x3c
c0019dc0 do_softirq+0x94
c000610c timer_interrupt+0x23c

What is happening is that ide_event is doing

	mod_timer(&link->release, jiffies + HZ/20);

on the card removal event, with link->release.function == ide_release.
Thus ide_release gets called on a timeout, and it calls
ide_unregister, which calls devfs_unregister, which does various
things which you shouldn't do in interrupt context, like calling
schedule and calling kmem_cache_alloc(..., SLAB_KERNEL).

So, is this devfs's fault for not allowing devfs_unregister to be
called from interrupt context, or is it ide-cs's fault for calling
ide_unregister from interrupt context?

Paul.