From mboxrd@z Thu Jan  1 00:00:00 1970
From: Philipp Hahn <hahn@univention.de>
Subject: Re: RFH: Kernel OOPS in xen_netbk_rx_action /
	xenvif_gop_skb
Date: Fri, 27 Jun 2014 19:48:36 +0200
Message-ID: <53ADAE74.9020905@univention.de>
References: <5391976F.8020800@univention.de>	<20140606105804.GD11959@zion.uk.xensource.com>	<53923CD0.7010001@univention.de>	<53A1C2DF.10407@univention.de>	<20140619141252.GO20819@zion.uk.xensource.com>	<53A84002.5050402@univention.de>
	<53AD2E70.5060002@univention.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta5.messagelabs.com ([195.245.231.135])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <hahn@univention.de>) id 1X0aGM-0002xt-Hj
	for xen-devel@lists.xenproject.org; Fri, 27 Jun 2014 17:48:38 +0000
In-Reply-To: <53AD2E70.5060002@univention.de>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Wei Liu <wei.liu2@citrix.com>
Cc: xen-devel <xen-devel@lists.xenproject.org>, Erik Damrose <Damrose@univention.de>, Ian Campbell <ian.campbell@citrix.com>, Zoltan Kiss <zoltan.kiss@citrix.com>
List-Id: xen-devel@lists.xenproject.org

Hello Wei Liu,

On 27.06.2014 10:42, Philipp Hahn wrote:
> With the modified patch we now get the following hang:
...
>> [ 1115.250900] INFO: task xenwatch:14 blocked for more than 120 seconds.
>> [ 1115.250902] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>> [ 1115.250904] xenwatch        D ffff8800952d9080     0    14      2 0x00000000
>> [ 1115.250907]  ffff8800952d9080 0000000000000246 ffff880094510880 0000000000013ec0
>> [ 1115.250909]  ffff88009530ffd8 0000000000013ec0 ffff88009530ffd8 0000000000013ec0
>> [ 1115.250911]  ffff8800952d9080 0000000000013ec0 0000000000013ec0 ffff88009530e010
>> [ 1115.250913] Call Trace:
>> [ 1115.250921]  [<ffffffff813ca32d>] ? _raw_spin_lock_irqsave+0x11/0x2f
>> [ 1115.250925]  [<ffffffffa040a396>] ? xenvif_free+0x7a/0xb6 [xen_netback]
...
> Any idea?

I guess we found the problem ourselves: For thus removed skb's the
reference counter on the associated vif was not decremented, as it is
normally done in two locations at the end of the function
xen_netbk_rx_action():

> Subject: [PATCH] quick hack
...
> diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
> index 36efb41..f4f3693 100644
> --- a/drivers/net/xen-netback/netback.c
> +++ b/drivers/net/xen-netback/netback.c
> @@ -720,6 +720,11 @@ static void xen_netbk_rx_action(struct xen_netbk *netbk)
>  		vif = netdev_priv(skb->dev);
>  		nr_frags = skb_shinfo(skb)->nr_frags;
>  
> +		if (!vif->mapped) {
> +			dev_kfree_skb(skb);

			xenvif_put(vif);

> +			continue;
> +		}
> +
>  		sco = (struct skb_cb_overlay *)skb->cb;
>  		sco->meta_slots_used = netbk_gop_skb(skb, &npo);
>  

The test is currently running again for the weekend and on Monday we
will hopefully know more.

Thanks again.

Philipp