Kernel panic when pfo driver accesses an invalid device path address at my_activepathchange() function.

Issue

• kernel panic when handling a paging request at 00000badf0add001

lpfc 0000:0a:00.0: 2:(0):0248 Cancel Discovery Timer state x20 Data: x110 x0 x0
 rport-10:0-3: blocked FC remote port time out: removing target and saving binding
lpfc 0000:27:00.1: 7:(0):0203 Devloss timeout on WWPN 50:00:00:00:00:00:00:01 NPort x123456 Data: x82000000 x8 x4
pfo: Detach 10:0:1:0 failover tape device wwnn=5000000000000001 wwpn=5000000000000001
pfo: Remove 10:0:1:0 
BUG: unable to handle kernel paging request at 00000badf0add001
IP: [<ffffffffa02ba4d3>] my_activepathchange+0xb3/0xd0 [pfo]
PGD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1c.0/0000:0a:00.0/host5/rport-5:0-6/fc_remote_ports/rport-5:0-6/node_name
CPU 26 
Modules linked in: mptctl mptbase sg vxodm(P)(U) lin_tape(U) sunrpc dmpjbod(P)(U) dmpap(P)(U) dmpaa(P)(U) vxspec(P)(U) vxio(P)(U) vxdmp(P)(U) bonding ipv6 vxportal(P)(U) fdd(P)(U) vxfs(P)(U) exportfs dm_multipath stmp(U) pfo(U) osst microcode ipmi_devintf iTCO_wdt iTCO_vendor_support hpwdt hpilo sfc i2c_algo_bit i2c_core mdio power_meter acpi_ipmi ipmi_si ipmi_msghandler tg3 ptp pps_core lpfc scsi_transport_fc scsi_tgt serio_raw lpc_ich mfd_core ioatdma dca shpchp ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom hpsa pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 1855, comm: fc_wq_10 Tainted: P           -- ------------    2.6.32-573.22.1.el6.x86_64 #1 HP ProLiant DL380p Gen8
RIP: 0010:[<ffffffffa02ba4d3>]  [<ffffffffa02ba4d3>] my_activepathchange+0xb3/0xd0 [pfo]
RSP: 0018:ffff8820107afc50  EFLAGS: 00010246
RAX: ffffffffa03cff20 RBX: ffff88200cad9800 RCX: 0000000000000008
RDX: 00000badf0add001 RSI: 0000000000000000 RDI: ffffffffa02c143c
RBP: ffff8820107afc70 R08: ffffffffa02c048c R09: ffff88201131c000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffffffa02c3860 R14: ffff88400e4be460 R15: ffff88401321e010
FS:  0000000000000000(0000) GS:ffff8820b0d40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00000badf0add001 CR3: 0000000001a8d000 CR4: 00000000000407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process fc_wq_10 (pid: 1855, threadinfo ffff8820107ac000, task ffff8820107a9520)
Stack:
 0000000000000000 000000000000003e ffff88200cad9800 000000000000003e
<d> ffff8820107afc90 ffffffffa02bbf69 ffff88200cad9800 000000000000007b
<d> ffff8820107afd30 ffffffffa02bc660 ffff88200000007a ffff88400000007a
Call Trace:
 [<ffffffffa02bbf69>] remove_subpath+0xe9/0x170 [pfo]
 [<ffffffffa02bc660>] intercept_remove+0x220/0x340 [pfo]
 [<ffffffff8120e02b>] ? sysfs_hash_and_remove+0x5b/0x90
 [<ffffffff813710b1>] device_del+0xd1/0x1e0
 [<ffffffff813711e2>] device_unregister+0x22/0x70
 [<ffffffff81399875>] __scsi_remove_device+0xb5/0xd0
 [<ffffffff813998c0>] scsi_remove_device+0x30/0x50
 [<ffffffff81399a62>] scsi_remove_target+0x162/0x200
 [<ffffffffa010c570>] ? fc_starget_delete+0x0/0x30 [scsi_transport_fc]
 [<ffffffffa010c596>] fc_starget_delete+0x26/0x30 [scsi_transport_fc]
 [<ffffffff8109ab40>] worker_thread+0x170/0x2a0
 [<ffffffff810a1820>] ? autoremove_wake_function+0x0/0x40
 [<ffffffff8109a9d0>] ? worker_thread+0x0/0x2a0
 [<ffffffff810a138e>] kthread+0x9e/0xc0
 [<ffffffff8100c28a>] child_rip+0xa/0x20
 [<ffffffff810a12f0>] ? kthread+0x0/0xc0
 [<ffffffff8100c280>] ? child_rip+0x0/0x20
Code: 48 8b bb c0 00 00 00 eb e4 0f 1f 80 00 00 00 00 31 f6 4d 85 e4 74 04 49 8b 34 24 83 bb 80 00 00 00 ff 74 14 48 8b 93 88 00 00 00 <48> 8b 3a ff d0 eb 9f 66 0f 1f 44 00 00 48 8b 93 c0 00 00 00 eb 
RIP  [<ffffffffa02ba4d3>] my_activepathchange+0xb3/0xd0 [pfo]
 RSP <ffff8820107afc50>
CR2: 00000badf0add001
(END)