v4.19-rc3, bug in __gnttab_unmap_refs_async with HVM domU

v4.19-rc3, bug in __gnttab_unmap_refs_async with HVM domU

[Olaf Hering]

[-- Attachment #1.1: Type: text/plain, Size: 2494 bytes --]

While preparing another variant of the fix for the bug in disable_hotplug_cpu, this crash happend for me while starting my HVM domU a second time. dom0 runs Xen 4.7.6.
I guess it crashed while it did shutdown the domU running a xenlinux based kernel.

Olaf

[ 8114.320383] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 8114.320416] PGD 1fd6a1f067 P4D 1fd6a1f067 PUD 1fd4b4a067 PMD 0
[ 8114.320427] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 8114.320435] CPU: 0 PID: 828 Comm: xenstored Tainted: G            E     4.19.321-default-bug1106594 #5
[ 8114.320444] Hardware name: HP ProLiant SL160z G6 /ProLiant SL160z G6 , BIOS O33 07/28/2009
[ 8114.320458] RIP: e030:__gnttab_unmap_refs_async+0x29/0x90
[ 8114.320464] Code: 00 66 66 66 66 90 53 8b 8f 80 00 00 00 31 c0 48 89 fb 48 8b 57 78 85 c9 75 09 eb 49 83 c0 01 39 c8 74 42 4c 63 c0 4e 8b 04 c2 <4d> 8b 48 08 41 f6 c1 01 75 4d 45 8b 40 34
 41 83 f8 01 7e de 8b 83
[ 8114.320480] RSP: e02b:ffffc900471d3bd8 EFLAGS: 00010297
[ 8114.320487] RAX: 0000000000000001 RBX: ffffc900471d3c20 RCX: 000000000000006c
[ 8114.320495] RDX: ffff881fd9f3eac0 RSI: ffffffff810ad2f0 RDI: ffffc900471d3c20
[ 8114.320503] RBP: 0000000002ccbdb0 R08: 0000000000000000 R09: dead000000000100
[ 8114.320511] R10: 0000000000001093 R11: ffff881fd3340840 R12: ffff880101609d80
[ 8114.320518] R13: 000000000000006c R14: ffff881fd68dbb01 R15: ffff880101609d80
[ 8114.320533] FS:  00007fd3352a3880(0000) GS:ffff881fdf400000(0000) knlGS:0000000000000000
[ 8114.320541] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8114.320548] CR2: 0000000000000008 CR3: 0000001fd33ca000 CR4: 0000000000002660
[ 8114.320560] Call Trace:
[ 8114.320569]  gnttab_unmap_refs_sync+0x40/0x60
[ 8114.320580]  __unmap_grant_pages+0x80/0x140 [xen_gntdev]
[ 8114.320587]  ? gnttab_unmap_refs_sync+0x60/0x60
[ 8114.320596]  ? __queue_work+0x3f0/0x3f0
[ 8114.320602]  ? gnttab_free_pages+0x20/0x20
[ 8114.320610]  unmap_grant_pages+0x80/0xe0 [xen_gntdev]
[ 8114.320618]  unmap_if_in_range+0x53/0xa0 [xen_gntdev]
[ 8114.320626]  mn_invl_range_start+0x4a/0xe0 [xen_gntdev]
[ 8114.320635]  __mmu_notifier_invalidate_range_start+0x6b/0xe0
[ 8114.320646]  unmap_vmas+0x71/0x90
[ 8114.320652]  unmap_region+0x9c/0xf0
[ 8114.320660]  ? __vma_rb_erase+0x109/0x200
[ 8114.320666]  do_munmap+0x213/0x390
[ 8114.320673]  __x64_sys_brk+0x13c/0x1b0
[ 8114.320682]  do_syscall_64+0x5d/0x110
[ 8114.320690]  entry_SYSCALL_64_after_hwframe+0x49/0xbe


[-- Attachment #1.2: Digitale Signatur von OpenPGP --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 157 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: v4.19-rc3, bug in __gnttab_unmap_refs_async with HVM domU

[Dongli Zhang]

The backtrace of the BUG is quite similar to a hang I encountered:

https://lists.xenproject.org/archives/html/xen-devel/2018-09/msg00454.html

No sure if they are related.

Dongli Zhang

On 09/10/2018 08:37 PM, Olaf Hering wrote:
> While preparing another variant of the fix for the bug in disable_hotplug_cpu, this crash happend for me while starting my HVM domU a second time. dom0 runs Xen 4.7.6.
> I guess it crashed while it did shutdown the domU running a xenlinux based kernel.
> 
> Olaf
> 
> [ 8114.320383] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
> [ 8114.320416] PGD 1fd6a1f067 P4D 1fd6a1f067 PUD 1fd4b4a067 PMD 0
> [ 8114.320427] Oops: 0000 [#1] PREEMPT SMP NOPTI
> [ 8114.320435] CPU: 0 PID: 828 Comm: xenstored Tainted: G            E     4.19.321-default-bug1106594 #5
> [ 8114.320444] Hardware name: HP ProLiant SL160z G6 /ProLiant SL160z G6 , BIOS O33 07/28/2009
> [ 8114.320458] RIP: e030:__gnttab_unmap_refs_async+0x29/0x90
> [ 8114.320464] Code: 00 66 66 66 66 90 53 8b 8f 80 00 00 00 31 c0 48 89 fb 48 8b 57 78 85 c9 75 09 eb 49 83 c0 01 39 c8 74 42 4c 63 c0 4e 8b 04 c2 <4d> 8b 48 08 41 f6 c1 01 75 4d 45 8b 40 34
>  41 83 f8 01 7e de 8b 83
> [ 8114.320480] RSP: e02b:ffffc900471d3bd8 EFLAGS: 00010297
> [ 8114.320487] RAX: 0000000000000001 RBX: ffffc900471d3c20 RCX: 000000000000006c
> [ 8114.320495] RDX: ffff881fd9f3eac0 RSI: ffffffff810ad2f0 RDI: ffffc900471d3c20
> [ 8114.320503] RBP: 0000000002ccbdb0 R08: 0000000000000000 R09: dead000000000100
> [ 8114.320511] R10: 0000000000001093 R11: ffff881fd3340840 R12: ffff880101609d80
> [ 8114.320518] R13: 000000000000006c R14: ffff881fd68dbb01 R15: ffff880101609d80
> [ 8114.320533] FS:  00007fd3352a3880(0000) GS:ffff881fdf400000(0000) knlGS:0000000000000000
> [ 8114.320541] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 8114.320548] CR2: 0000000000000008 CR3: 0000001fd33ca000 CR4: 0000000000002660
> [ 8114.320560] Call Trace:
> [ 8114.320569]  gnttab_unmap_refs_sync+0x40/0x60
> [ 8114.320580]  __unmap_grant_pages+0x80/0x140 [xen_gntdev]
> [ 8114.320587]  ? gnttab_unmap_refs_sync+0x60/0x60
> [ 8114.320596]  ? __queue_work+0x3f0/0x3f0
> [ 8114.320602]  ? gnttab_free_pages+0x20/0x20
> [ 8114.320610]  unmap_grant_pages+0x80/0xe0 [xen_gntdev]
> [ 8114.320618]  unmap_if_in_range+0x53/0xa0 [xen_gntdev]
> [ 8114.320626]  mn_invl_range_start+0x4a/0xe0 [xen_gntdev]
> [ 8114.320635]  __mmu_notifier_invalidate_range_start+0x6b/0xe0
> [ 8114.320646]  unmap_vmas+0x71/0x90
> [ 8114.320652]  unmap_region+0x9c/0xf0
> [ 8114.320660]  ? __vma_rb_erase+0x109/0x200
> [ 8114.320666]  do_munmap+0x213/0x390
> [ 8114.320673]  __x64_sys_brk+0x13c/0x1b0
> [ 8114.320682]  do_syscall_64+0x5d/0x110
> [ 8114.320690]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xenproject.org
> https://lists.xenproject.org/mailman/listinfo/xen-devel
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel