Re: Kernel Panic in xen-blkfront.c:blkif_queue_request under 2.6.28

[Jeremy Fitzhardinge <jeremy@goop.org>]

Jens Axboe wrote:
> To shed some more light on this, I'd suggest changing that BUG_ON() to
> some code that simply dumps each segment (each bvec in the iterator
> list) from start to finish along with values of
> request->nr_phys_segments and size info.
>   

OK, something like this?

    J

Subject: xen/blkfront: try to track down over-segment BUG_ON in blkfront

Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
---
 drivers/block/xen-blkfront.c |   24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

===================================================================
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -240,7 +240,10 @@
 
 	ring_req->nr_segments = 0;
 	rq_for_each_segment(bvec, req, iter) {
-		BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
+		if (WARN_ON(ring_req->nr_segments >=
+			    BLKIF_MAX_SEGMENTS_PER_REQUEST))
+			goto dump_req;
+
 		buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
 		fsect = bvec->bv_offset >> 9;
 		lsect = fsect + (bvec->bv_len >> 9) - 1;
@@ -274,6 +277,25 @@
 	gnttab_free_grant_references(gref_head);
 
 	return 0;
+
+dump_req:
+	{
+		int i;
+
+		printk(KERN_DEBUG "too many segments for ring (%d): "
+		       "req->nr_phys_segments = %d\n",
+		       BLKIF_MAX_SEGMENTS_PER_REQUEST, req->nr_phys_segments);
+
+		i = 0;
+		rq_for_each_segment(bvec, req, iter) {
+			printk(KERN_DEBUG
+			       "  %d: bio page %p pfn %lx off %u len %u\n",
+			       i++, bvec->bv_page, page_to_pfn(bvec->bv_page),
+			       bvec->bv_offset, bvec->bv_len);
+		}
+	}
+
+	return 1;
 }