Re: [PATCHv5 12/14] xen-blkback: safely unmap grants in case they are still in use

["Roger Pau Monné" <roger.pau@citrix.com>]

El 09/03/15 a les 12.02, David Vrabel ha escrit:
> On 09/03/15 10:51, Bob Liu wrote:
>>
>> On 03/09/2015 05:30 PM, David Vrabel wrote:
>>> On 09/03/15 09:09, Bob Liu wrote:
>>>> Hi David,
>>>>
>>>> Recently I met an issue which is likely related with this patch. It
>>>> happened when running block benchmark on domU, the backend was an iSCSI
>>>> disk connected to dom0. I got below panic at put_page_testzero() on
>>>> dom0, at that time the ixgbe network card was freeing skb pages in
>>>> __skb_frag_unref() but the page->_count was already 0.
>>>> Do you think is it possiable that page was already freed by blkback?
>>>
>>> It's possible, but in this case I think the blkback device must have
>>> been destroyed for this to have happened,  because blkback doesn't free
>>> the pages until it is destroyed.
>>>
>>
>> Sorry, I didn't get the point here, doesn't bio_complete free pages?
>> E.g.
>> __end_block_io_op() > xen_blkbk_unmap_and_respond() > put_free_pages()
>> Then shrink_free_pagepool() free the page finally.
> 
> Ug. That's all the persistent grant stuff I'm not very familiar with.
> Perhaps Roger can comment?

This is the cache of ballooned-out pages that's used to map grants, it's
not directly related to persistent grants. From time to time the buffer
of ballooned-out pages is checked and maybe some of them are freed if
the amount is too high, but at that point the grant has already been
unmapped, so it would fail anyway if someone tried to access that page.

> 
>> I'm worry about there may be race condition some place and caused this
>> panic, but it's hard to locate. It may exist in xen-blkback/grant or
>> even the ixgbe network driver itself.
> 
> Actually, freeing the page in blkback early shouldn't cause this sort of
> thing anyway, since the skb should hold additional refs to the pages.

Yes. Blkback only unmaps the page when the bio is done, so the problem
might be that the network driver marks the bio as done and tries to
access it later?

Roger.