System crashes at RIP : device_pm_remove() when trying to remove device entries for a scsi target device.

Issue

• System crashes with following call traces:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [] device_pm_remove+0x42/0xb0
PGD 0 
Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/0000:03:00.0/0000:04:00.0/0000:05:00.0/0000:06:01.0/0000:08:00.0/host10/rport-10:0-1/target10:0:0/10:0:0:0/state
CPU 25 
Modules linked in: 8021q garp stp llc autofs4 nfs lockd fscache auth_rpcgss nfs_acl sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf tcp_diag inet_diag sg power_meter acpi_ipmi ipmi_si ipmi_msghandler microcode iTCO_wdt iTCO_vendor_support joydev sb_edac edac_core lpc_ich mfd_core shpchp ext4 jbd2 mbcache dm_round_robin sd_mod crc_t10dif fnic libfcoe libfc scsi_transport_fc scsi_tgt enic ahci crc32c_intel be2iscsi igb bnx2i dca cnic i2c_algo_bit uio i2c_core cxgb4i ptp pps_core cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi dm_multipath dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]

Pid: 1977, comm: fc_wq_11 Not tainted 2.6.32-696.1.1.el6.x86_64 #1 Cisco Systems Inc UCSC-C220-M4S/UCSC-C220-M4S
RIP: 0010:[]  [] device_pm_remove+0x42/0xb0
RSP: 0018:ffff880471b37c80  EFLAGS: 00010286
RAX: ffff880366f2dcc8 RBX: ffff880366f2dc28 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81b19160
RBP: ffff880471b37c90 R08: 00000000000002a0 R09: ffff880879c76000
R10: ffff880879c76000 R11: 0000000000000000 R12: ffff880143214828
R13: ffffffffa02e4720 R14: ffffffff81387c80 R15: ffff880471a86010
FS:  0000000000000000(0000) GS:ffff88048e520000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 0000000001a8d000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process fc_wq_11 (pid: 1977, threadinfo ffff880471b34000, task ffff880471b2cab0)
Stack:
 ffff880471b37c90 ffff880366f2dc28 ffff880471b37cc0 ffffffff81380131
 0000000000010068 ffff880366f2dc28 ffff880366f2dc28 ffffffffa02e4720
 ffff880471b37ce0 ffffffff8138756e ffff880471b37d10 ffff880875190068
Call Trace:
 [] device_del+0x41/0x200
 [] attribute_container_class_device_del+0x1e/0x30
 [] transport_remove_classdev+0x53/0x70
 [] attribute_container_device_trigger+0xa0/0xe0
 [] transport_remove_device+0x15/0x20
 [] scsi_target_reap_usercontext+0x29/0x50
 [] execute_in_process_context+0x55/0x60
 [] scsi_target_reap+0xb8/0xe0
 [] scsi_remove_target+0x1a9/0x1c0
 [] ? fc_starget_delete+0x0/0x30 [scsi_transport_fc]
 [] fc_starget_delete+0x26/0x30 [scsi_transport_fc]
 [] worker_thread+0x170/0x2a0
 [] ? autoremove_wake_function+0x0/0x40
 [] ? worker_thread+0x0/0x2a0
 [] kthread+0x9e/0xc0
 [] child_rip+0xa/0x20
 [] ? kthread+0x0/0xc0
 [] ? child_rip+0x0/0x20
Code: fb 75 51 48 c7 c7 60 91 b1 81 e8 6a 1e 1c 00 48 8b 8b a0 00 00 00 48 8b 93 a8 00 00 00 48 8d 83 a0 00 00 00 48 c7 c7 60 91 b1 81 <48> 89 51 08 48 89 0a 48 89 83 a0 00 00 00 48 89 83 a8 00 00 00 
RIP  [] device_pm_remove+0x42/0xb0
 RSP 
CR2: 0000000000000008