Re: Trying to unmap invalid handle! pending_idx: @ drivers/net/xen-netback/netback.c:998 causes kernel panic/reboot

[Zoltan Kiss <zoltan.kiss@citrix.com>]

Hi,

I've already identified 2 issues in xenvif_tx_check_gop:

- (*gopp_copy)++ happens before we print the error message, though its 
only effect that the error message becomes incorrect
- a more severe issue is that if there is a mapping problem on the frags 
(or on the frag_list skb), AND the first TX request is entirely grant 
copied ( !(data_len < txreq.size) in build_gops), that pending_idx is 
never released. The frags are released but then the function returns, 
skb is freed and the while loop goes to next iteration. In the normal 
path it should be released a bit later in that loop, at the "Schedule a 
response immediately" comment.

However, I don't see yet how this second issue should cause this problem.

Zoltan