[Xen-devel] netback regression in 3.16-rc1

[Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>]

After guest's netfront dies as I described in previous message and we 
try to clean up (xl destroy), dom0 blows up:
[ 5402.155064] BUG: unable to handle kernel paging request at 
00000000000032f0
[ 5402.155077] IP: [<ffffffff814dd7c5>] xenvif_free+0x65/0x130
[ 5402.155089] PGD 2bc33067 PUD 2c59d067 PMD 0
[ 5402.155101] Oops: 0000 [#1] SMP
[ 5402.155107] Modules linked in: dm_multipath dm_mod xen_evtchn 
iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi 
libcrc32c crc32c_generic crc32c_intel nouveau mxm_wmi radeon ttm sg 
sd_mod crct10dif_generic sr_mod crc_t10dif cdrom crct10dif_common i915 
fbcon tileblit font bitblit softcursor ahci libahci tpm_tis libata 
scsi_mod e1000e drm_kms_helper video wmi xen_blkfront xen_netfront 
fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd
[ 5402.155209] CPU: 1 PID: 36 Comm: xenwatch Tainted: G        W 
3.16.0-rc1upstream-00003-g7074232-dirty #1
[ 5402.155220] Hardware name: LENOVO ThinkServer TS130/        , BIOS 
9HKT47AUS 01/10/2012
[ 5402.155231] task: ffff880039a5b610 ti: ffff880039da4000 task.ti: 
ffff880039da4000
[ 5402.155238] RIP: e030:[<ffffffff814dd7c5>] [<ffffffff814dd7c5>] 
xenvif_free+0x65/0x130
[ 5402.155249] RSP: e02b:ffff880039da7c78  EFLAGS: 00010246
[ 5402.155257] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 
0000000000000000
[ 5402.155263] RDX: 0000000000000000 RSI: ffffffff81c90200 RDI: 
ffff88002a946458
[ 5402.155268] RBP: ffff880039da7cc8 R08: 0000000000000000 R09: 
0000000000000024
[ 5402.155274] R10: ffff88003a000b70 R11: dead000000200200 R12: 
0000000000000000
[ 5402.155283] R13: 000000000000001e R14: 0000000000000000 R15: 
0000000000000000
[ 5402.155297] FS:  00007fca4f4ba700(0000) GS:ffff88003fc80000(0000) 
knlGS:0000000000000000
[ 5402.155304] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5402.155309] CR2: 00000000000032f0 CR3: 000000002d418000 CR4: 
0000000000042660
[ 5402.155315] Stack:
[ 5402.155318]  0000000000000000 ffff88002ba28cc0 0000000400000000 
ffff88002a9467c0
[ 5402.155329]  ffffffff81c899d8 ffff880039a329c0 ffff8800398e1000 
ffffffff81c899d8
[ 5402.155337]  ffffffff81c899d8 0000000000000000 ffff880039da7ce8 
ffffffff814dcff8
[ 5402.155351] Call Trace:
[ 5402.155357]  [<ffffffff814dcff8>] netback_remove+0x58/0x80
[ 5402.155368]  [<ffffffff814050e8>] xenbus_dev_remove+0x38/0x70
[ 5402.155376]  [<ffffffff8147eab4>] __device_release_driver+0x64/0xd0
[ 5402.155385]  [<ffffffff8147ec18>] device_release_driver+0x28/0x40
[ 5402.155393]  [<ffffffff8147dd6a>] bus_remove_device+0x12a/0x170
[ 5402.155399]  [<ffffffff8147b628>] device_del+0x118/0x1d0
[ 5402.155405]  [<ffffffff8147b6f1>] device_unregister+0x11/0x20
[ 5402.155411]  [<ffffffff814dd43f>] frontend_changed+0x9f/0x110
[ 5402.155419]  [<ffffffff81405398>] xenbus_otherend_changed+0xa8/0xb0
[ 5402.155427]  [<ffffffff816f052b>] ? _raw_spin_unlock_irqrestore+0x1b/0x70
[ 5402.155435]  [<ffffffff814034c0>] ? xenbus_transaction_start+0x60/0x60
[ 5402.155442]  [<ffffffff814055ab>] frontend_changed+0xb/0x10
[ 5402.155451]  [<ffffffff81403562>] xenwatch_thread+0xa2/0x160
[ 5402.155460]  [<ffffffff810e39e0>] ? bit_waitqueue+0xd0/0xd0
[ 5402.155470]  [<ffffffff814034c0>] ? xenbus_transaction_start+0x60/0x60
[ 5402.155477]  [<ffffffff810c3fde>] kthread+0xce/0xf0
[ 5402.155487]  [<ffffffff8103c359>] ? xen_end_context_switch+0x19/0x20
[ 5402.155494]  [<ffffffff810c3f10>] ? 
kthread_freezable_should_stop+0x80/0x80
[ 5402.155501]  [<ffffffff816f0abc>] ret_from_fork+0x7c/0xb0
[ 5402.155507]  [<ffffffff810c3f10>] ? 
kthread_freezable_should_stop+0x80/0x80

I believe we are last seen in xenvif_wait_unmap_timeout() with queue 
being NULL.
-boris


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel