From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeremy Fitzhardinge Subject: Re: Kernel Panic in xen-blkfront.c:blkif_queue_request under 2.6.28 Date: Mon, 02 Feb 2009 15:30:36 -0800 Message-ID: <4987821C.9040605@goop.org> References: <11750686.8060601233586380769.JavaMail.root@ouachita> <33412370.8060681233586404023.JavaMail.root@ouachita> <20090202161425.GK30821@kernel.dk> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20090202161425.GK30821@kernel.dk> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Jens Axboe Cc: Greg Harris , xen-devel List-Id: xen-devel@lists.xenproject.org Jens Axboe wrote: > To shed some more light on this, I'd suggest changing that BUG_ON() to > some code that simply dumps each segment (each bvec in the iterator > list) from start to finish along with values of > request->nr_phys_segments and size info. > OK, something like this? J Subject: xen/blkfront: try to track down over-segment BUG_ON in blkfront Signed-off-by: Jeremy Fitzhardinge --- drivers/block/xen-blkfront.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) =================================================================== --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -240,7 +240,10 @@ ring_req->nr_segments = 0; rq_for_each_segment(bvec, req, iter) { - BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST); + if (WARN_ON(ring_req->nr_segments >= + BLKIF_MAX_SEGMENTS_PER_REQUEST)) + goto dump_req; + buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page)); fsect = bvec->bv_offset >> 9; lsect = fsect + (bvec->bv_len >> 9) - 1; @@ -274,6 +277,25 @@ gnttab_free_grant_references(gref_head); return 0; + +dump_req: + { + int i; + + printk(KERN_DEBUG "too many segments for ring (%d): " + "req->nr_phys_segments = %d\n", + BLKIF_MAX_SEGMENTS_PER_REQUEST, req->nr_phys_segments); + + i = 0; + rq_for_each_segment(bvec, req, iter) { + printk(KERN_DEBUG + " %d: bio page %p pfn %lx off %u len %u\n", + i++, bvec->bv_page, page_to_pfn(bvec->bv_page), + bvec->bv_offset, bvec->bv_len); + } + } + + return 1; }