Red Hat Enterprise Linux 5.3 kernel panic due to corrupted I/O request free list in the LSI MPT Fusion scsi driver

Issue

• System running Red Hat Enterprise Linux 5.3 panicked with syslog full of messages from the LSI MPT Fusion driver:

    mptbase: ioc2: LogInfo(0x30050000): Originator={IOP}, Code={Task Terminated}, SubCode(0x0000)

• Concluding with :

    se: ioc2: LogInfo(0x30050000): Originator={IOP}, Code={Task Terminated}, SubCode(0x0000)
    mptbase: ioc2: LogInfo(0x30050000): Originator={IOP}, Code={Task Terminated}, SubCode(0x0000)
    mptbase: ioc2: LogInfo(0x31130000): Originator={PL}, Code={IO Not Yet Executed}, SubCode(0x0000)
    mptbase: ioc2: LogInfo(0x31130000): Originator={PL}, Code={IO Not Yet Executed}, SubCode(0x0000)
    list_add corruption. prev->next should be ffff810827596160, but was ffff810827285600

• Immediately after reporting the list_add corruption, the system tripped a BUG_ON and paniced with the following stack backtrace :

    mptbase: ioc2: LogInfo(0x31140000): Originator={PL}, Code={IO Executed}, SubCode(0x0000)
    mptbase: ioc2: LogInfo(0x31130000): Originator={PL}, Code={IO Not Yet Executed}, SubCode(0x0000)
    list_add corruption. prev->next should be ffff810427547160, but was ffff810427284b00
    ----------- [cut here ] --------- [please bite here ] ---------
    Kernel BUG at lib/list_debug.c:31
    invalid opcode: 0000 [1] SMP 
    last sysfs file: /class/sas_device/end_device-2:0/sas_address
    CPU 5 
    [...]
    Pid: 0, comm: swapper Not tainted 2.6.18-128.1.6.el5 #1
    RIP: 0010:[<ffffffff8014c75c>]  [<ffffffff8014c75c>] __list_add+0x48/0x68
    [...]
    Call Trace:
     <IRQ>  [<ffffffff880d7d91>] :mptbase:mpt_free_msg_frame+0x3f/0x53
     [<ffffffff880dd63d>] :mptbase:mpt_interrupt+0x7e7/0x986
     [<ffffffff8808904c>] :scsi_mod:scsi_end_request+0xbf/0xcd
     [<ffffffff880891a8>] :scsi_mod:scsi_io_completion+0x14e/0x324
     [<ffffffff8808943d>] :scsi_mod:scsi_device_unbusy+0x67/0x81
     [<ffffffff80010a46>] handle_IRQ_event+0x51/0xa6
     [<ffffffff800b7b65>] __do_IRQ+0xa4/0x103
     [<ffffffff8006c95d>] do_IRQ+0xe7/0xf5
     [<ffffffff8006b287>] default_idle+0x0/0x50
     [<ffffffff8005d615>] ret_from_intr+0x0/0xa
     <EOI>  [<ffffffff8006b2b0>] default_idle+0x29/0x50
     [<ffffffff80048d26>] cpu_idle+0x95/0xb8
     [<ffffffff80076c3c>] start_secondary+0x45a/0x469
    [...]