[linux-cifs-client] slab error: cache `cifs_small_rq': Can't free all objects

[Jeff Layton]

On Thu, 20 Nov 2008 22:35:55 +0300
Igor Mammedov <niallain at gmail.com> wrote:

> While testing DFS root code, I've stumbled upon following error:
> 
> [  145.145962]  /tmp/linux-2.6.22.9/kernel/fs/cifs/cifsfs.c: exit_cifs
> [  145.147948] slab error in kmem_cache_destroy(): cache `cifs_small_rq': Can't free all objects
> [  145.148371] Pid: 1895, comm: rmmod Not tainted 2.6.28-rc5 #28
> [  145.148722] Call Trace:
> [  145.149003]  [<c0457e52>] kmem_cache_destroy+0x5a/0x9e
> [  145.149303]  [<c7e80071>] cifs_destroy_request_bufs+0x2b/0x2d [cifs]
> [  145.149617]  [<c7e9ea12>] exit_cifs+0x4e/0xca [cifs]
> [  145.149940]  [<c042dc40>] sys_delete_module+0x158/0x1a4
> [  145.150232]  [<c040f469>] ? do_page_fault+0x27f/0x532
> [  145.150519]  [<c040381d>] sysenter_do_call+0x12/0x21
> 
> Then I returned to original Steve git tree and get the same error.
> 
> To reproduce it run something like this: 
> 
> # while /bin/true; do insmod cifs.ko ; mount bla /bla; umount /bla; rmmod cifs done
> 
> That's probably caused by alive cifs_demultiplex_thread because we only tell it to die
> in umount, but we do not wait till it will happen.
> 
> PS:
> Seldom I can get more nasty oops messages.
> 

Thanks,

Sounds like we may need to take a module reference when we start cifsd
and have it exit with module_put_and_exit(). I'll have a look when I
get a chance.

-- 
Jeff Layton <jlayton at redhat.com>