Re: RFH: Kernel OOPS in xen_netbk_rx_action / xenvif_gop_skb

[Philipp Hahn <hahn@univention.de>]

Hello Wei Liu,

On 27.06.2014 10:42, Philipp Hahn wrote:
> With the modified patch we now get the following hang:
...
>> [ 1115.250900] INFO: task xenwatch:14 blocked for more than 120 seconds.
>> [ 1115.250902] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> [ 1115.250904] xenwatch        D ffff8800952d9080     0    14      2 0x00000000
>> [ 1115.250907]  ffff8800952d9080 0000000000000246 ffff880094510880 0000000000013ec0
>> [ 1115.250909]  ffff88009530ffd8 0000000000013ec0 ffff88009530ffd8 0000000000013ec0
>> [ 1115.250911]  ffff8800952d9080 0000000000013ec0 0000000000013ec0 ffff88009530e010
>> [ 1115.250913] Call Trace:
>> [ 1115.250921]  [<ffffffff813ca32d>] ? _raw_spin_lock_irqsave+0x11/0x2f
>> [ 1115.250925]  [<ffffffffa040a396>] ? xenvif_free+0x7a/0xb6 [xen_netback]
...
> Any idea?

I guess we found the problem ourselves: For thus removed skb's the
reference counter on the associated vif was not decremented, as it is
normally done in two locations at the end of the function
xen_netbk_rx_action():

> Subject: [PATCH] quick hack
...
> diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
> index 36efb41..f4f3693 100644
> --- a/drivers/net/xen-netback/netback.c
> +++ b/drivers/net/xen-netback/netback.c
> @@ -720,6 +720,11 @@ static void xen_netbk_rx_action(struct xen_netbk *netbk)
>  		vif = netdev_priv(skb->dev);
>  		nr_frags = skb_shinfo(skb)->nr_frags;
>  
> +		if (!vif->mapped) {
> +			dev_kfree_skb(skb);

			xenvif_put(vif);

> +			continue;
> +		}
> +
>  		sco = (struct skb_cb_overlay *)skb->cb;
>  		sco->meta_slots_used = netbk_gop_skb(skb, &npo);
>  

The test is currently running again for the weekend and on Monday we
will hopefully know more.

Thanks again.

Philipp