[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] Trying to unmap invalid handle! pending_idx: @ drivers/net/xen-netback/netback.c:998 causes kernel panic/reboot



Hi,

I've already identified 2 issues in xenvif_tx_check_gop:

- (*gopp_copy)++ happens before we print the error message, though its only effect that the error message becomes incorrect - a more severe issue is that if there is a mapping problem on the frags (or on the frag_list skb), AND the first TX request is entirely grant copied ( !(data_len < txreq.size) in build_gops), that pending_idx is never released. The frags are released but then the function returns, skb is freed and the while loop goes to next iteration. In the normal path it should be released a bit later in that loop, at the "Schedule a response immediately" comment.

However, I don't see yet how this second issue should cause this problem.

Zoltan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.