From mboxrd@z Thu Jan 1 00:00:00 1970 From: Boris Ostrovsky Subject: netback regression in 3.16-rc1 Date: Tue, 17 Jun 2014 22:05:18 -0400 Message-ID: <53A0F3DE.4010303@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wx5E4-0003jo-Mq for xen-devel@lists.xenproject.org; Wed, 18 Jun 2014 02:03:48 +0000 List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel Cc: andrew.bennieston@citrix.com, Wei Liu List-Id: xen-devel@lists.xenproject.org After guest's netfront dies as I described in previous message and we try to clean up (xl destroy), dom0 blows up: [ 5402.155064] BUG: unable to handle kernel paging request at 00000000000032f0 [ 5402.155077] IP: [] xenvif_free+0x65/0x130 [ 5402.155089] PGD 2bc33067 PUD 2c59d067 PMD 0 [ 5402.155101] Oops: 0000 [#1] SMP [ 5402.155107] Modules linked in: dm_multipath dm_mod xen_evtchn iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi libcrc32c crc32c_generic crc32c_intel nouveau mxm_wmi radeon ttm sg sd_mod crct10dif_generic sr_mod crc_t10dif cdrom crct10dif_common i915 fbcon tileblit font bitblit softcursor ahci libahci tpm_tis libata scsi_mod e1000e drm_kms_helper video wmi xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd [ 5402.155209] CPU: 1 PID: 36 Comm: xenwatch Tainted: G W 3.16.0-rc1upstream-00003-g7074232-dirty #1 [ 5402.155220] Hardware name: LENOVO ThinkServer TS130/ , BIOS 9HKT47AUS 01/10/2012 [ 5402.155231] task: ffff880039a5b610 ti: ffff880039da4000 task.ti: ffff880039da4000 [ 5402.155238] RIP: e030:[] [] xenvif_free+0x65/0x130 [ 5402.155249] RSP: e02b:ffff880039da7c78 EFLAGS: 00010246 [ 5402.155257] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 5402.155263] RDX: 0000000000000000 RSI: ffffffff81c90200 RDI: ffff88002a946458 [ 5402.155268] RBP: ffff880039da7cc8 R08: 0000000000000000 R09: 0000000000000024 [ 5402.155274] R10: ffff88003a000b70 R11: dead000000200200 R12: 0000000000000000 [ 5402.155283] R13: 000000000000001e R14: 0000000000000000 R15: 0000000000000000 [ 5402.155297] FS: 00007fca4f4ba700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000 [ 5402.155304] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5402.155309] CR2: 00000000000032f0 CR3: 000000002d418000 CR4: 0000000000042660 [ 5402.155315] Stack: [ 5402.155318] 0000000000000000 ffff88002ba28cc0 0000000400000000 ffff88002a9467c0 [ 5402.155329] ffffffff81c899d8 ffff880039a329c0 ffff8800398e1000 ffffffff81c899d8 [ 5402.155337] ffffffff81c899d8 0000000000000000 ffff880039da7ce8 ffffffff814dcff8 [ 5402.155351] Call Trace: [ 5402.155357] [] netback_remove+0x58/0x80 [ 5402.155368] [] xenbus_dev_remove+0x38/0x70 [ 5402.155376] [] __device_release_driver+0x64/0xd0 [ 5402.155385] [] device_release_driver+0x28/0x40 [ 5402.155393] [] bus_remove_device+0x12a/0x170 [ 5402.155399] [] device_del+0x118/0x1d0 [ 5402.155405] [] device_unregister+0x11/0x20 [ 5402.155411] [] frontend_changed+0x9f/0x110 [ 5402.155419] [] xenbus_otherend_changed+0xa8/0xb0 [ 5402.155427] [] ? _raw_spin_unlock_irqrestore+0x1b/0x70 [ 5402.155435] [] ? xenbus_transaction_start+0x60/0x60 [ 5402.155442] [] frontend_changed+0xb/0x10 [ 5402.155451] [] xenwatch_thread+0xa2/0x160 [ 5402.155460] [] ? bit_waitqueue+0xd0/0xd0 [ 5402.155470] [] ? xenbus_transaction_start+0x60/0x60 [ 5402.155477] [] kthread+0xce/0xf0 [ 5402.155487] [] ? xen_end_context_switch+0x19/0x20 [ 5402.155494] [] ? kthread_freezable_should_stop+0x80/0x80 [ 5402.155501] [] ret_from_fork+0x7c/0xb0 [ 5402.155507] [] ? kthread_freezable_should_stop+0x80/0x80 I believe we are last seen in xenvif_wait_unmap_timeout() with queue being NULL. -boris